How to manage API licenses for digital products in WooCommerce

Decide whether each purchase receives one product licence or an account-level key, how many sites or devices it may activate, whether licences expire, and what happens when a customer renews or cancels. Keep the product identifier stable, especially if the software is updated later.

For subscription products, decide whether access ends immediately when the subscription becomes inactive or remains available until the paid period ends. Write this down before configuring the store so your validation responses match your sales terms.

Edit the WooCommerce product and mark it as Virtual and Downloadable if it is software delivered online. Add the software file or update package, set the download restrictions you require, and use a unique product identifier in the licensing system.

Orders for virtual and downloadable products can move to completed automatically, which is important when licence generation depends on the order reaching the completed status. A common Friday-afternoon failure is expecting a key immediately while the order is still processing.

WooCommerce alone can sell the file, but it does not create a complete customer licence service. A developer must create a licence record after payment, expose a protected endpoint, and validate the submitted key, product identifier, customer entitlement, expiry date and activation count.

The software should create and retain a unique instance identifier for each installation, then use it for status checks and deactivation. You also need an admin screen or database process for revoking activations, handling lost devices and recording requests. This route is reasonable for one product with a technical owner, but it becomes maintenance work as soon as you add renewals, upgrades or automatic updates.

Whether you build the integration or use an extension, activation requests should send the licence key, product identifier and a unique instance value. Store the instance value securely and reuse it for later status checks; generating a new value on every request can consume activation slots.

For the WooCommerce API Manager workflow, activation, deactivation and status checks are separate requests. The documented activation request requires an API key, product ID and instance, while status checks confirm whether the activation and time limit are still valid. Pass a fixed product ID rather than relying on a value that can change between product variations.

Test a first activation, a repeat activation with the same instance, a second device after the activation limit, deactivation, an expired licence, a cancelled subscription and a product upgrade. Confirm that the software fails safely when the licensing server is unavailable rather than locking out every existing customer immediately.

Do not confuse WooCommerce REST API keys with customer licence keys. REST API keys authenticate an application that reads or writes store data; they are not the activation credentials you should distribute with software. Keep store API credentials server-side and use a separate licence response for the customer application.

The fast route is to install a WooCommerce licensing extension such as WooCommerce API Manager, create the API-enabled product, set its activation and expiry rules, and connect your plugin or application to the supplied API or integration library. The documented workflow supports product keys, master keys, activation limits, status checks, deactivation and update delivery.

This is the better choice when you sell more than one product or need customer self-service, renewal handling, activation reporting and update delivery without maintaining the licensing database and API yourself. Test the complete purchase-to-activation path before enabling automatic updates for customers.