Kestrel API Manager for WooCommerce

Selling plugins or SaaS with WooCommerce? You’ll need to manage licenses, restrict activations, send updates, and keep customers happy.

The Kestrel API Manager does all of that (and more). It’s a flexible license key and update delivery system built for WooCommerce. Drop it in, connect your software, and start selling like a pro.

Getting started with API Manager

↑ Back to top

1. Buy WooCommerce API Manager
2. Drop in the SDK: our GitHub library handles most of the hard parts.
3. Test your API setup: use the included Postman collection or your own HTTP tool.
4. Start selling licenses: track activations, send updates, and scale your store.

Popular use cases for Kestrel API License Manager:

• WordPress plugin & theme licensing
  Issue license keys, restrict activations, and deliver updates directly from WooCommerce.
• SaaS access control & API monetization
  Authenticate users, enforce usage limits, and verify subscriptions via your own API.
• Mobile app subscriptions
  Sell app access through WooCommerce and manage licenses across devices.
• Software downloads & updates
  Provide secure, expiring download links hosted locally, on S3, or externally.
• Memberships & digital unlocks
  Use license keys to gate content, files, or courses – integrates seamlessly with Constellation.

Whether you’re delivering updates, verifying activations, or migrating from another license manager, the Kestrel API Manager handles the heavy lifting with a clean admin UI and flexible REST APIs. It supports both simple and subscription-based products, integrates deeply with WooCommerce Subscriptions, and works with local, remote, or S3-hosted update files.

Updating the Kestrel API Manager

↑ Back to top

This plugin powers your software validation. A broken update could block activations or lock customers out.

While WooCommerce offers solid guidelines for updating plugins, it’s especially important to take those seriously when updating this one. Why? Because you’re using it as a validation server for your own software. One mistake could block updates or break license checks for your customers.

Best practices:

• Always back up your site before updating, major or minor.
• Test updates in staging before going live, especially with major releases.
• Make sure your PHP Library is compatible with the new version of the API Manager.
• If you’re using custom API clients, validate that key requests still work as expected.

When in doubt, reach out to support before upgrading. We’ll help you avoid surprises.

Setting up your first WooCommerce licensing product

↑ Back to top

Getting started with the Kestrel API Manager to sell your first digital download product is as easy as:

1. Enable API licensing for your product
   • Create or edit your product in WooCommerce.
   • Check the “API” checkbox to mark it as a licensed item.
   • Fill out the fields in the “API” tab (e.g., number of activations, download counts, and more).
   • For variable products, configure each variation individually.
2. Add the SDK to your product
   • Use the Kestrel PHP Library for Plugins and Themes to connect your WordPress plugin or theme to the API Manager.
   • Or build your own API client based on the API docs.
3. Test it
   • API Resources are created from customer orders. Create an order and you’ll have a license to test against.
   • You can view activations in the WooCommerce admin, and test license behavior using Postman or your preferred tool.
4. Sell like any other WooCommerce product
   • When a customer buys an API-enabled product, license keys are automatically generated. They are stored on the Woo order and then show up in the customer’s email confirmation and My Account area.
   • If you’re using WooCommerce Subscriptions, activations and keys will sync accordingly.

Now you’re ready to sell, track, and protect your licensed software. All directly from your WooCommerce store.

Here’s our more detailed guide on how to configure your individual WooCommerce products to work with the Kestrel API Manager.

API Manager setup guides

↑ Back to top

• Quick Setup Guide: API Manager Products
• Detailed API Manager settings guide

API Manager Product Tabs

↑ Back to top

In the main settings, you can enable “Add tabs to frontend product pages” when using a theme that supports tabs such as the Storefront theme. WooCommerce Products will be automatically populated with tabs, and content for those tabs, when the product is an API Manager Product. Just setup the API Products as usual, and the feature does the rest, so you don’t need to write the same content a second time into tab meta boxes on the product.

API Key Types

↑ Back to top

When a customer buys a product associated with the API Manager (called an API Resource), they receive a key that grants access. There are two main types of keys:

Type	Best for	Can access	Changeable?	Notes
Master License Key	Customers who want one key for everything	All API Resources	Yes, by admin	Tracks all purchases and activations
Product License Key	Store owners who want one key per product	One API Resource per order	No	A new key is created for each product/order

We recommend using the Master License Key by default, it avoids the need to reactivate when purchases change and provides an easier user experience. Use the product license key when you believe it necessary for your business requirements.

To activate a product, the API key must be passed along with other values in the request. See the API documentation for full details.

When are API Resources/Licenses created?

↑ Back to top

Licenses are created for all paid order statuses, including:

• Completed
• Processing
• Any custom status marked as ‘paid’

This means as long as the order has been paid, your customer’s license and activations will be created.

If the order moves to an unpaid status (like Cancelled or Failed), the associated API Resources and activations are removed.

If the order is later restored to a paid status, API Resources will be re-created, but the activations will not. This prevents customers from running into errors due to leftover activations and keeps things clean.

Check out our Order screen guide for more information on how to manage API Manager licensing orders.

How it works with recurring billing solutions

↑ Back to top

• When a customer buys a subscription product, API access is automatically granted.
• All license keys (API Keys) and activation slots are managed under the parent order.
• If a customer switches subscription plans, API access moves to the new switched order.
• Licenses only stay active when the subscription is in Active or Pending Cancellation status.

See the documentation on using API Manager with recurring billing via Constellation or WooCommerce Subscriptions for more detail.

Connect your plugin or app to the API

↑ Back to top

PHP Library for WordPress Plugins and Themes

↑ Back to top

We offer a lightweight, drop-in library that connects your WooCommerce extension, WordPress plugin, or theme to the WooCommerce API Manager for license validation and update delivery.

Learn more and get started →

For everything else

↑ Back to top

If you’re building a custom integration, you’ll need to send a few required fields, like the API Key and a unique Instance ID, with each request for validation and updates.

Need to integrate with the API Manager? This section covers the full API specification, including authentication, request formats, and available endpoints for managing activations, updates, and license checks.

API Specifications and Documentation

Using Postman for API response testing

↑ Back to top

A preconfigured Postman .json file collection template is included to make it easy to test the API endpoints. Server URL, and keys/values, will need to be modified specific to your product and server.

Preview the license manager dashboard

↑ Back to top

The API Customers dashboard shows key info for each customer and their API-enabled orders. Each row represents one product on an order. You can search by email, Order ID, Product ID, or User ID, and sort some columns.

To manage activations or change expiration dates, click the Order ID link to open the full order screen with activation controls.

Control your customer’s access (even after purchase)

↑ Back to top

Replace or disable a master license

↑ Back to top

You can manage a customer’s Master API Key by editing their user profile under Users > [Username].

• You can disable or replace the Master API Key, but not delete it entirely.
• If you disable it:
  • All license keys tied to that user (Master or product) will stop working.
  • The customer won’t be able to access any API endpoints.
  • Their My Account page will show the account is disabled.
• If you replace it:
  • All current activations for that user will be wiped, and therefore disabled.
  • This includes any activations tied to their Product level keys, as the product keys are imbued with activations by the parent “master license key”.

The Master API Key is the top-level license, if it’s off, nothing else works.

Using the User Switching plugin

↑ Back to top

When you’re troubleshooting a customer’s license issue, sometimes the easiest way to see what they see is… to be them.

The User Switching plugin lets store admins instantly log in as any user without needing their password. You can view their My Account dashboard, check their API Keys and Downloads, and confirm everything is working — including any template overrides or role-based logic.

Just don’t forget to switch back when you’re done.

Your customer’s experience

↑ Back to top

Once a customer purchases an API-enabled product, their API Keys and downloads become available in the My Account area.

This dashboard shows all current licenses (API Resources), individual product keys, expiration details, activation counts, and download links, everything your customers need to manage their software access. Here’s a resource on how it all works.

Expiration, Renewals, and Access

↑ Back to top

When one of your customers is dealing with an expiring API license, here’s what they’ll see and how they’ll interact with it:

1. Pre-expiration reminders:
   Your customer will receive an email reminder 30 days before the license expires, and another 7 days before. These emails include:
   • The expiration date
   • A one-click renewal link that adds the correct product to the cart
   • Any active renewal discount offer
2. My Account alerts:
   In their My Account > API Keys page, customers will see a Renew button next to any API Key that’s close to expiration.
3. Post-expiration behavior (Grace Period):
   If the license expires, a final email is sent the day after with a message like:
   “This license is expired but still renewable until [Grace Period date].”
   The API Key is still renewable during this period, and the Renew button remains visible in My Account.
4. After the Grace Period:
   Once the grace period ends, the customer must repurchase the license. The Renew option disappears.

For a complete guide, check out this resource: API Manager: License Expiration, Renewal, and Grace Periods

Caching and performance

↑ Back to top

The API Manager uses a SmartCache engine to dramatically speed up API and database queries while reducing server load. It only updates cached data when changes occur or when expired data is requested. Combined with object caching, this enables fast, scalable performance even under heavy load.

Curious how it performs under stress? Check out our benchmark results for real-world data on load handling and speed.

Disabling cache during active development

To disable SmartCache during testing or troubleshooting, add this to your wp-config.php:

define( 'WC_AM_ENABLE_CACHE', false );

Homepage caching

↑ Back to top

By default, the homepage is excluded from caching to avoid breaking API calls made via query strings. If you’re confident in your caching setup and want to enable homepage caching, use this:

define( 'WC_AM_DISABLE_HOMEPAGE_CACHE', false );

Then make sure your caching plugin or CDN excludes this query string:

wc-api=wc-am-api

See the API documentation for more information regarding query strings.

Software update file hosting optimization

↑ Back to top

The file used for software updates can be hosted on the local server, Amazon S3, or from any remote URL. The file download URL is wrapped in a secure URL that expires after the expire time you set. To set up Amazon S3, use this guide.

Getting help with your software licensing setup

↑ Back to top

Support & Compatibility

↑ Back to top

We follow WooCommerce’s L-1 support policy, which means:

• We officially support the latest version and the version just before that.
• To get support, make sure you’re running a recent version of:
  • WordPress
  • WooCommerce
  • Constellation or WooCommerce Subscriptions (if you’re using it)
  • Kestrel API Manager

Keeping things up to date helps us help you faster and ensures everything plays nicely together.

What our support covers (and what it doesn’t)

↑ Back to top

We’re here to make sure the API Manager is working properly on your WooCommerce store. That includes license validation, activations, and API functionality.

If you’re building external software (like a mobile app, custom SaaS, or client integration), we’re happy to offer basic guidance, but full implementation or debugging of your custom tools is outside our support policy.

That said, you should reach out anyway. If we can point you in the right direction, we will.

Troubleshooting tips

↑ Back to top

• Use a supported PHP version. Keep your PHP version updated before it reaches end-of-life. Check current supported versions.
• Use HTTPS. Your store must run on a secure connection for proper API usage.
• Add WordPress security keys. The API Manager uses AUTH_KEY and NONCE_SALT from wp-config.php for encryption. Generate new keys here.
• Disable WP_DEBUG in production. Set define('WP_DEBUG', false); in wp-config.php. Debug output can break API responses.
• Don’t cache query strings. Caching the homepage URL with query strings can break API requests. Most caching plugins are auto-handled, but check your config. Especially if you’re using Cloudflare.
• Check your firewall. Some firewalls block query strings and break API calls.
• Never delete API products. Once a product is marked for API use, its product_id is required for activation. Deleting it breaks all associated client activations.
• Duplicated a product? Make sure the new copy has its own API key config.

Additional troubleshooting and FAQ

Migrating from software license managers

↑ Back to top

WooCommerce Software Add-on

Kestrel API Manager includes a built-in migration tool for stores using the WooCommerce Software Add-on. It lets you import license data directly, and the API Manager will continue to respond to WC Software Add-on-style API queries during the transition. Once the import is complete and everything is tested, you can safely deactivate or remove the old plugin.

Clients can migrate at their own pace, and gradually update their software to take full advantage of the API Manager’s more powerful licensing system.

Need help migrating from something else?

If you’re moving from Freemius, Easy Digital Downloads, or another licensing tool, we’re happy to help. Reach out to support and we’ll walk you through what to export, what to import, and how to make the transition as smooth as possible.

Need more help?

↑ Back to top

• Already purchased? Open a support request and we’ll take a look.
• Have questions before you buy? Send us a quick note, we’re happy to chat.