SunLicense

SpigotMC ​

SpigotMC injects three placeholders into premium resources: %%__USER__%% (the buyer's user ID), %%__RESOURCE__%% and %%__NONCE__%% (unique per download). SpigotMC has no API for purchases, so SunLicense can't confirm a purchase. What it can do is give each buyer their own license, so machine limits apply per buyer and a leaked jar can be shut off by revoking one person's license.

1. Connect it in SunLicense ​

Integrations → SpigotMC → Connect. Map your resource ID to a policy (or *).

Optional: Allowed buyer IDs. Paste the user IDs from your resource's buyer list and only those get a key. Leave it empty to give a key to any ID SpigotMC injected.

2. In your plugin ​

java
// SpigotMC replaces these when a buyer downloads the jar.
String body = "{\"user\":\"%%__USER__%%\",\"resource\":\"%%__RESOURCE__%%\",\"nonce\":\"%%__NONCE__%%\"}";
HttpResponse<String> res = HttpClient.newHttpClient().send(
        HttpRequest.newBuilder(URI.create(HOOK_URL))      // the integration's hook URL
                .header("Content-Type", "application/json")
                .POST(HttpRequest.BodyPublishers.ofString(body)).build(),
        HttpResponse.BodyHandlers.ofString());
if (res.statusCode() != 200) { /* not a premium download, or not on the buyer list */ }
String licenseKey = new ObjectMapper().readTree(res.body()).path("key").asText();
// Validate licenseKey with the SDK like any other license.

The response is {"key": "...", "status": "ACTIVE"}. Values that weren't replaced (a build you compiled yourself) are refused with 400.

Limits, honestly ​

  • Anyone who pulls the URL out of your jar can ask for keys for invented user IDs. Those licenses don't belong to real buyers, so revoke freely; the gateway rate-limits the endpoint and your plan's license limit caps the damage. The allow-list closes it completely, at the cost of updating it.
  • No refund signal: revoke refunded buyers from the license page.
  • Like every client-side check, a determined cracker can remove it. Per-buyer keys make leaks traceable and stoppable, which is the realistic goal.