API reference

The one call CloudLoader makes at startup. Given just a server token, returns every attached product ready to use — no manual per-product setup. Revoked or suspended licenses are silently excluded, so a customer server never has to handle that itself.

Rate limit: 30/min

{
  "server_token": "srv_..."
}

{
  "server_name": "My Main Server",
  "products": [
    {
      "product_id": "PRD-123456",
      "product_name": "Dispatch System",
      "api_key": "pk_...",
      "license_key": "XXXX-XXXX-XXXX-XXXX",
      "api_base": "https://this-or-a-custom-domain.com",
      "channel": "stable"
    }
  ]
}

Unauthenticated health check. Used to verify a custom domain is actually reaching this platform before it goes live for anyone.

Rate limit: unlimited

{ "ok": true, "platform": "CloudLoader Platform" }

Validates a license using only the public api_key — this is what a distributed script should call, since the secret_key never has to leave your dashboard. Also accepts an optional channel ("stable" or "beta").

Rate limit: 120/min

{
  "api_key": "pk_...",
  "license_key": "XXXX-XXXX-XXXX-XXXX",
  "server_id": "optional, e.g. sv_hostname"
}

{ "valid": true, "product": { "name": "...", "version": "..." } }
{ "valid": false, "message": "License is revoked." }

The elevated version of license activation — requires the private secret_key too. Meant for your own server-side integrations (a website checking a customer's status), never for anything distributed to customers.

Rate limit: 120/min

{
  "api_key": "pk_...",
  "secret_key": "sk_...",
  "license_key": "XXXX-XXXX-XXXX-XXXX",
  "server_id": "optional"
}

{
  "valid": true,
  "product": { "name": "...", "version": "..." },
  "license": { "status": "active", "expires_at": null }
}

Compares a version string you send against the product's current published version.

Rate limit: 60/min

{ "api_key": "pk_...", "current_version": "1.0.0" }

{ "latest_version": "1.2.0", "update_available": true }

Lists modules available to a specific license. Pass channel: "beta" to also receive beta overrides — you still get every stable module too; beta never means fewer modules, just newer ones where a developer has published an override.

Rate limit: 60/min

{
  "api_key": "pk_...",
  "license_key": "XXXX-XXXX-XXXX-XXXX",
  "channel": "stable"
}

{
  "modules": [
    { "name": "menu", "display_name": "Test Menu", "side": "server", "version": "1.0.0", "channel": "stable" }
  ]
}

Returns the actual Lua source for one module. This is what makes code "delivered from the platform" — it never has to exist as a file on the customer's disk.

Rate limit: 60/min

{
  "api_key": "pk_...",
  "license_key": "XXXX-XXXX-XXXX-XXXX",
  "channel": "stable"
}

{
  "name": "menu",
  "side": "server",
  "version": "1.0.0",
  "channel": "stable",
  "code": "RegisterCommand(...)"
}

Returns whatever JSON object a developer has published as that product's remote config — values they can change live without republishing any code. {} if nothing is set.

Rate limit: 60/min

{ "api_key": "pk_...", "license_key": "XXXX-XXXX-XXXX-XXXX" }

{ "config": { "maxCalls": 10, "cooldownSeconds": 30 } }

Where Tebex purchase events land. The signature is HMAC-SHA256 of the raw request body using the product's webhook secret (from the product's Tebex settings page) — this is what you paste into Tebex's own webhook configuration, not something you call directly.

Rate limit: 60/min

{
  "email": "customer@example.com",
  "package_id": "optional - filtered against integration setting",
  "quantity": 1
}

{ "status": "ok", "license_keys": ["XXXX-XXXX-XXXX-XXXX"] }