Marketplace integrations
Connect the stores you sell on and every purchase gets its own SunLicense license, with no copy-pasting. Refunds and chargebacks revoke the license, ended subscriptions suspend it.
Open Integrations in the dashboard, pick a marketplace, choose which policy its products are sold as, and paste the URL and secret SunLicense gives you into the marketplace. Each guide below has the exact clicks.
| Marketplace | How the buyer gets the key | Refund → revoke | Guide |
|---|---|---|---|
| BuiltByBit | Written into the jar they download | Manual | BuiltByBit |
| Voxel Shop (Polymart) | Written into the download | ✅ Automatic | Voxel Shop |
| SpigotMC | Your plugin trades SpigotMC's injected buyer ID for the key | Manual | SpigotMC |
| Tebex | Redeem page (transaction ID) | ✅ | Tebex |
| Gumroad | Gumroad's own key, from the receipt | ✅ | Gumroad |
| Lemon Squeezy | Lemon Squeezy's own key, from the receipt | ✅ | Lemon Squeezy |
| Payhip | Payhip's own key, or the redeem page | ✅ | Payhip |
| Ko-fi | Redeem page (transaction ID) | — | Ko-fi |
| itch.io | Redeem page (download link) | — | itch.io |
| Stripe | Shown on the checkout success page | ✅ | Stripe |
| WooCommerce | Redeem page (order number) | ✅ | WooCommerce |
| Envato (CodeCanyon, ThemeForest) | Redeem page (purchase code) | — | Envato |
Selling on Modrinth, CurseForge, Hangar or wordpress.org? Read Free platforms first: their rules limit what a license check may do.
How it works
- One URL per connected store. It looks like
https://api.sunlicense.com/api/v1/integrations/hooks/<token>. The token tells SunLicense whose store it is; every request is also checked against the marketplace's own signature or secret, so a leaked URL alone can't create licenses (except on Gumroad and SpigotMC, which don't sign; see their guides). Danger zone → New URL replaces it if it leaks. - Products map to policies. "Resource 12345 is sold as Premium (2 machines, lifetime)". Use
*to send every product of the store to one policy. Purchases of unmapped products are logged and skipped. - One license per purchase. Re-downloads, renewals and redelivered webhooks find the same license. A buyer who was refunded and buys again gets a new one (revocation is permanent).
- Keys from the marketplace. Gumroad, Lemon Squeezy and Payhip already email buyers a key. With Use the store's key on (the default), that exact key becomes the SunLicense key, so buyers use what is in their receipt.
- Licenses show their source. A license page says via BuiltByBit; marketplace buyers without an email are named by their marketplace user ID (e.g. BuiltByBit user 4242).
- Event log. Each integration page lists what the store sent and what SunLicense did: issued, existing, revoked, ignored (and why), rejected (bad signature) or failed (e.g. plan limit reached).
The redeem page
Stores that can't show our key to the buyer get a public page at https://app.sunlicense.com/redeem/<token>. Link it from your product page, receipt or download notes.
- itch.io and Envato: the buyer pastes their download link or purchase code; SunLicense confirms it with the marketplace's API and issues the key.
- Webhook stores (Tebex, Gumroad, Lemon Squeezy, Payhip, Ko-fi, WooCommerce): the buyer enters the order/transaction ID and the email they bought with. A wrong email gets the same answer as an unknown order.
- Stripe: redirect Checkout to the page with
?session_id={CHECKOUT_SESSION_ID}and the key appears as soon as the payment is confirmed.
Keys are shown masked, with reveal and copy buttons.
Permissions
integrations.read lets a member see integrations and their event log; integrations.write lets them connect stores, change mappings and see secrets. Owners, Admins and Developers have both; Support and Viewers can read. See Team and roles.
Plan limits
Marketplace licenses count towards your plan's license limit. If the limit is reached the purchase is logged as failed and the store gets an error (most retry later); upgrade and it goes through.
API
Everything on the Integrations page is also in the Management API.