Stores and the API

Let a store, a bot or a script run Atlas for you: hand out a key after every sale, ban a buyer on a chargeback, reset a machine from a support console.

Open it now:Settings, API and webhooks

Pick the job

Settings, API and webhooks opens with four jobs. Choose one and the page shows only what that job needs, with the address filled in with your token so you can paste it into the other tool.

Job	What the tool does
Deliver keys after a sale	Sellauth, Sellix, Sellpass, Shoppy or any store that can call a web address when someone pays. The store gets a fresh key back and shows it to the buyer.
Ban on a chargeback	A payment webhook bans the buyer's license, machine and address when the money is taken back, and can unban if it is reversed.
Run support from a console	A bot or admin panel resets a machine, adds time, pauses or resumes a key, looks a key up or ends a session.
Write my own script	Walkthroughs for each store and Discord bot, and code for Node.js, Python and PHP.

Auto-delivery

Create a token with Storefront auto-delivery on and set what each delivered key looks like: its mask, its validity, its level and a note. The token then has one delivery address. It accepts a plain GET or POST, ignores the body (so the store's order data does no harm), and answers with the key at the top level, where every store's template finds it:

JSON

Delivery response

{ "ok": true, "key": "ATLAS-K7X2M-9QD4B", "keys": ["ATLAS-K7X2M-9QD4B"], "license": { "key": "ATLAS-K7X2M-9QD4B", "expiry": null, "duration_days": 30, "level": 1, "note": null } }

The address is https://atlas.se.net/api/v1/deliver/ followed by the token. Each call makes one key and counts against the token's limits and your plan's license cap. The key's clock starts at its first sign-in, so expiry is empty in the answer.

Answer	Means
`401 invalid_token`	The token does not exist or was revoked.
`404 delivery_disabled`	Auto-delivery is off on this token.
`403 missing_scope`	The token lost `license.generate`. Tick it again in Edit.
`403 ip_not_allowlisted`	The store's address is not on the token's allowlist.
`402 license_quota_reached`	Your plan's license limit is reached.
`429 rate_limit_minute`, `rate_limit_hour`	The token's limit was reached. The answer says how long to wait.
`429 too_many_invalid_tokens`	That address sent 15 invalid tokens in ten minutes and is blocked for ten minutes.

The endpoints

Every endpoint lives under https://atlas.se.net/api/v1/apps/APP_ID/, where APP_ID is your application's number. A token goes in an Authorization: Bearer header, or in a token query parameter for tools that can only edit a URL. A body can be JSON; licenses.generate also reads its settings from the query string.

Endpoint	Does	Scope needed
`POST licenses.generate` (also `GET`)	Makes keys. `count` 1 to 1,000. `mask` (`` random, `#` digit, `$` uppercase, `%` lowercase; anything else literal; default `KEY-**-###`). `duration` with `duration_type` (`days`, `weeks`, `months`, `years`, `lifetime`; `hours` and `minutes` are rounded to whole days, at least one). `level` 1 to 100. `note`. `charset` as a comma list of `uppercase`, `lowercase`, `numbers`, `symbols` (default uppercase and numbers). `exclude_ambiguous`. `entitlements`. Leaving out `duration` makes lifetime keys. Returns `key`, `keys` and `licenses`.	`license.generate`
`GET licenses/KEY`	Reads one license: hardware ID, last IP, level, note, expiry, duration, paused, banned, created and last login.	`license.read`
`POST licenses.ban`	Bans a `license_key`, with an optional `reason` and `expiry`. One ban covers the key, its hardware ID and its last IP address. The key must exist. A session that is already running ends at its next heartbeat.	`license.ban`
`POST licenses.unban`	Removes the bans recorded against that `license_key`.	`license.ban`
`POST licenses.reset`	Clears the hardware and IP binding of a `license_key`.	`license.reset`
`POST licenses.pause`, `licenses.resume`	Pauses or resumes a `license_key`. Paused time is not used up.	`license.pause`
`POST licenses.extend`	Adds time: `license_key`, `amount` (a negative number takes time away) and `unit` (`minutes`, `hours`, `days`, `weeks`, `months` or `years`). On a key that has not been used yet it changes the validity it will start with.	`license.extend`
`DELETE licenses/KEY`	Deletes a license and its recorded hardware.	`license.delete`
`GET sessions`	Lists live sessions, newest first, up to 500: id, license key, hardware ID, IP, connected and last seen.	`session.read`
`POST sessions.kick`	Ends the sessions of a `license_key`, or one by `session_id`. The program ends at its next heartbeat. Account sessions are listed under the key `user:NAME`.	`session.kick`

Terminal

Ban on a chargeback

curl -X POST "https://atlas.se.net/api/v1/apps/APP_ID/licenses.ban" \
  -H "Authorization: Bearer atlas_ik_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "license_key": "ATLAS-K7X2M-9QD4B", "reason": "Chargeback, order 12345" }'

Terminal

Generate a key from a URL

curl "https://atlas.se.net/api/v1/apps/APP_ID/licenses.generate?token=atlas_ik_YOUR_TOKEN&count=1&mask=ATLAS-*****-*****&duration=30&duration_type=days&level=1"

A failed call answers with a short code such as missing_token, invalid_token, missing_scope, license_key_required, license_not_found, amount_required or bad_unit. The token's Activity list shows each call with its code.

Security of a token

The token is shown once, when you create it. Atlas keeps only a hash and the last four characters, so a lost token is rotated, not recovered.
Give each token only the scopes it needs. A chargeback webhook needs license.ban and nothing else.
Limit it to the store's addresses with the IP allowlist, so a delivery address that leaks in a screenshot cannot be replayed from elsewhere.
Every call is recorded in the token's Activity and in the application's audit record, with the token's name as the actor.

Was this page useful?