What you get

License products — SKU, max devices, optional expiry
Entitlements — each purchase or manual issue creates a tracked license tied to an API key
HWID binding — executors and games send a device fingerprint on verify
Roblox user lock — optional buyer user ID mismatch triggers critical alerts
Leak alerts — device limit abuse and shared-key attempts appear in the dashboard
Update channel — publish releases; valid licenses receive update.downloadUrl on verify
Storefront adapters — normalize Gumroad, Sellix, SellAuth, PayPal, and Roblox payloads on your webhook proxy

Create a product

Dashboard → Licenses → Create product. Set SKU, name, max devices (1–10), and duration in days (0 = lifetime).

Issue or auto-deliver

Manual: Licenses → Issue license, pick the product, optionally bind a Roblox user ID.

On purchase: Auto-Delivery → generate API key, select the license product, attach to a webhook with a storefront adapter. Purchases create both the key and entitlement.

Verify endpoint

POST https://developer.nexrbx.com/api/developer/licenses/verify

{
  "key": "nex_dev_…",
  "hwid": "device-fingerprint",
  "robloxUserId": "123456789"
}

The legacy /api/developer/api-keys/verify endpoint still works and returns license metadata when the key has an entitlement.

Successful response

{
  "success": true,
  "valid": true,
  "keyName": "Pro Script license",
  "product": { "sku": "pro-script", "name": "Pro Script Access" },
  "maxDevices": 1,
  "devicesUsed": 1,
  "expiresAt": "2026-06-22T00:00:00.000Z",
  "update": {
    "version": "1.2.0",
    "downloadUrl": "https://…",
    "changelog": "Bug fixes"
  }
}

Common failure reasons: device_limit, user_mismatch, expired, revoked, quota_exceeded.

Storefront adapters

Webhook proxy → Settings → Storefront adapter. Pick Gumroad, Sellix, SellAuth, PayPal, or Roblox commerce. Incoming payloads are normalized to event, userId, and email before auto-delivery runs.

Roblox verify example

local HttpService = game:GetService("HttpService")
local VERIFY_URL = "https://developer.nexrbx.com/api/developer/licenses/verify"

local function verifyNexLicense(key, hwid, userId)
  local ok, response = pcall(function()
    return HttpService:PostAsync(
      VERIFY_URL,
      HttpService:JSONEncode({
        key = key,
        hwid = hwid,
        robloxUserId = userId and tostring(userId) or nil
      }),
      Enum.HttpContentType.ApplicationJson
    )
  end)
  if not ok then return false end
  local data = HttpService:JSONDecode(response)
  return data.valid == true
end