Two levels

• Organization - packages and keys shared across every repo in the org (/{org}/-/licenses).
• Repository - the same, scoped to one repo, plus per-repo update-feed URLs (/{owner}/{repo}/licenses).

License packages

A package defines a subscription tier (for example “Pro Annual” or “Basic Monthly”):

• Duration - key validity in days (0 = lifetime).
• Max sites - maximum unique domains a key may activate (0 = unlimited).
• Channels - which update streams the package grants access to.
• Active - whether the package is currently sold.

Every org/repo also gets a protected Master (Internal) package with an internal key - unlimited access to all channels; it can be revoked but not edited or deleted.

License keys

• Keys look like MOKO-XXXX-XXXX-XXXX-XXXX and are hashed (SHA-256) before storage - the full key is shown once at creation, so store it securely.
• Each key can carry a licensee name/email, a domain restriction, a max-sites override, and a custom expiry date.

Gating downloads

License keys tie into the Update Server: set a repository's Feed Visibility to Require license key and consumers must present a valid key to list versions and download updates. Domain and channel access are checked at validation time.

Selling & automation (API)

• Purchase webhook - POST /api/v1/repos/{owner}/{repo}/license-keys/purchase creates a key from a payment event (Stripe, PayPal, etc.). A payment_ref makes it idempotent, so a retried webhook returns the existing key instead of creating a duplicate.
• Validation - the public POST .../license-keys/validate endpoint checks a key + domain for client-side license checks.
• Admin endpoints (token + repo admin) manage packages and keys - list, create, edit, delete, and view usage logs.

Where to manage it

• Repository: {owner}/{repo} → Licenses.
• Organization: {org} → Licenses (shared across all repos in the org).

Get help

Open a support ticket or call (931) 820-0265.