Voxel Shop (formerly Polymart)

Voxel Shop gives SunLicense two signed channels: an External API placeholder that writes each buyer's key into the download, and webhooks for purchases and refunds. A refund or chargeback revokes the key automatically.

1. Connect it in SunLicense

Integrations → Voxel Shop → Connect. Map your product ID (the number in voxel.shop/product/<id>) to a policy, or *. You can paste the secrets now or later.

2. Key injection (placeholder)

1. Edit your product → Security → add a custom placeholder, type External API.
2. Placeholder key: e.g. %%__SUNLICENSE__%%. Endpoint: the hook URL from the integration page.
3. Copy the API signing secret shown on the placeholder card into the integration (API signing secret).
4. Use the Test your integration button on Voxel Shop: the response should be {"value":"XXXX-XXXX-XXXX-XXXX"}.

private static final String LICENSE_KEY = "%%__SUNLICENSE__%%";
// validate LICENSE_KEY with the SDK, as in the BuiltByBit guide

3. Purchases and refunds (webhooks)

1. Product page → Webhooks → add a webhook with the same hook URL.
2. Select Purchases and Purchase removed (refunds and chargebacks).
3. Paste the webhook secret Voxel Shop shows into the integration (Webhook secret).
4. Click Send a ping: the integration's event log shows ping · ignored.

Security

Both channels send X-Polymart-Signature, an HMAC-SHA256 of the raw body: placeholder calls with the API signing secret, webhooks with the webhook secret. Requests whose signature doesn't match, or whose time is more than 5 minutes off, are refused.

Behaviour

Voxel Shop sends	SunLicense does
Placeholder call (download)	Returns the buyer's key, creating the license on the first download
product.user.purchase	Creates the buyer's license (a new one if their previous one was revoked)
product.user.purchaseRemoved	Revokes it
ping, product.update, product.user.firstDownload	Logged, nothing else

A refunded buyer who downloads again gets their revoked key, not a new one.