Licensing settings (add-on)
Store-wide licensing settings, including the response-signing secret.
Store-wide licensing settings, including the response-signing secret. See Licenses.
Read the licensing settings
/api/v1/kahunacart/licenses/settings
The store-wide licensing settings every rule falls back to: whether licensing is on, whether keys are issued when payment lands or when the order completes, the issuance defaults, the key layout with a sample key drawn by the class that mints them, the public API switches and rate limits, and the delivery copy and files. The signing secret is never returned in full, only as its last four characters with signing_secret_set beside it. writable says whether the config file can be written at all; where it cannot, the two writing tools answer 405.
Save the licensing settings
/api/v1/kahunacart/licenses/settings
Save store-wide licensing settings to the plugin's config file. Partial by design: only the keys sent are written and each nested block is merged rather than replaced, so saving the delivery copy cannot blank the key format on its way past. The signing secret is refused at any price, because a form posting the mask back would replace the real secret with bullets; rotate_signing_secret is the only door it goes through. A bad issue trigger, order data key, key format, default, origin, rate limit or license file answers 422 and nothing is written. A site whose config directory cannot be written answers 405. Changing the key layout only affects keys issued from then on.
Parameters
| Name | Type | Description |
|---|---|---|
| enabled optional | boolean | Master switch for licensing across the store |
| issue_on optional | string |
Whether keys are minted when payment lands or when the order completes
One of:
paid, completed |
| order_data_key optional | string | Key the issued licenses are recorded under on the order |
| key optional | object | The store's default key layout, inherited by every rule that overrides nothing. Keys: `prefix`, `blocks`, `block_length`, `alphabet`, `separator`, `template` |
| defaults optional | object | What issuance uses when a rule says nothing. Keys: `seats`, `term_days`, `updates_days`, `keys_per_qty` |
| api optional | object | The public validation API. `signing_secret` is not writable here. Keys: `enabled`, `cors_origins`, `rate_limit` |
| delivery optional | object | The copy the customer reads when a key arrives, written in the placeholder vocabulary from get_license_settings. Keys: `email_intro`, `page_intro`, `instructions`, `files` |
Rotate the response signing secret
/api/v1/kahunacart/licenses/settings/rotate-secret
Mint a new API signing secret, write it to the plugin config and return it once. This is a one-way door and it breaks things on purpose. The old secret stops verifying the moment this returns, so every client pinned to it starts rejecting genuine answers, and because the same secret signs license files, every file already downloaded stops verifying too. Do it when you mean to, not as routine hygiene, and only when the caller has asked for it in as many words. The full secret is in secret and is the only time it leaves the server; afterwards it is only ever reported as its last four characters. A site whose config directory cannot be written answers 405.
Both writes answer 405 on an installation with nowhere to write plugin configuration; the read response says so up front on its writable flag.
Caution
Rotating the secret is a one-way door. Every client still holding the old one starts failing signature checks.