Licensing and updates API for plugin developers

{
  "success": true,
  "status": "active",
  "activated": true,
  "site": "example.com",
  "license": {
    "status": "active",
    "expires_at": "2027-10-23T14:02:11.000Z",
    "site_limit": 5,
    "unlimited": false,
    "activations": 2,
    "activations_left": 3
  },
  "product": "bankbridge",
  "plan": "5 sites",
  "message": "License activated for example.com."
}

{
  "success": true,
  "slug": "bankbridge",
  "name": "BankBridge",
  "version": "1.3.0",
  "new_version": "1.3.0",
  "update_available": true,
  "package": "https://pluginloom.com/api/v1/download?v=...&l=...&e=...&s=...",
  "download_url": "https://pluginloom.com/api/v1/download?v=...",
  "url": "https://pluginloom.com/plugins/bankbridge",
  "tested": "6.9",
  "requires": "6.4",
  "requires_php": "8.1",
  "last_updated": "2026-11-02 10:00:00",
  "sections": { "description": "<p>...</p>", "installation": "<p>...</p>", "changelog": "<h4>1.3.0</h4>..." },
  "license_status": "active"
}

new PluginLoom_Updater( __FILE__, 'bankbridge', BANKBRIDGE_VERSION, get_option( 'bankbridge_license_key', '' ) );

<?php
/**
 * PluginLoom license + update client. GPL-2.0-or-later.
 */
if ( ! defined( 'ABSPATH' ) ) { exit; }

class PluginLoom_Updater {
	const API = 'https://pluginloom.com/api/v1';

	private $file; private $slug; private $version; private $key; private $basename; private $cache_key;

	public function __construct( $file, $slug, $version, $key ) {
		$this->file      = $file;
		$this->slug      = $slug;
		$this->version   = $version;
		$this->key       = trim( (string) $key );
		$this->basename  = plugin_basename( $file );
		$this->cache_key = 'pluginloom_upd_' . md5( $slug . $this->key );

		add_filter( 'pre_set_site_transient_update_plugins', array( $this, 'check_update' ) );
		add_filter( 'plugins_api', array( $this, 'plugin_info' ), 20, 3 );
		add_action( 'upgrader_process_complete', array( $this, 'purge' ), 10, 0 );
	}

	/** Activate, check or deactivate. Returns the decoded body or WP_Error. */
	public function license( $action, $key = null ) {
		$res = wp_remote_post( self::API . '/licenses/' . $action, array(
			'timeout' => 15,
			'headers' => array( 'Content-Type' => 'application/json' ),
			'body'    => wp_json_encode( array(
				'license_key'    => $key ? $key : $this->key,
				'site_url'       => home_url(),
				'instance'       => $this->instance(),
				'plugin_version' => $this->version,
				'wp_version'     => get_bloginfo( 'version' ),
				'php_version'    => PHP_VERSION,
			) ),
		) );
		if ( is_wp_error( $res ) ) { return $res; }
		return json_decode( wp_remote_retrieve_body( $res ), true );
	}

	private function instance() {
		$id = get_option( 'pluginloom_instance_' . $this->slug );
		if ( ! $id ) { $id = wp_generate_uuid4(); update_option( 'pluginloom_instance_' . $this->slug, $id, false ); }
		return $id;
	}

	private function remote() {
		$data = get_transient( $this->cache_key );
		if ( false !== $data ) { return $data; }
		$url = add_query_arg( array(
			'slug'    => $this->slug,
			'version' => $this->version,
			'key'     => $this->key,
			'site'    => home_url(),
		), self::API . '/update' );
		$res = wp_remote_get( $url, array( 'timeout' => 15 ) );
		if ( is_wp_error( $res ) || 200 !== wp_remote_retrieve_response_code( $res ) ) {
			set_transient( $this->cache_key, null, HOUR_IN_SECONDS ); // back off on failure
			return null;
		}
		$data = json_decode( wp_remote_retrieve_body( $res ) );
		set_transient( $this->cache_key, $data, 12 * HOUR_IN_SECONDS );
		return $data;
	}

	public function check_update( $transient ) {
		if ( empty( $transient->checked ) ) { return $transient; }
		$r = $this->remote();
		if ( ! $r || empty( $r->new_version ) ) { return $transient; }
		$item = (object) array(
			'id'            => $this->basename,
			'slug'          => $this->slug,
			'plugin'        => $this->basename,
			'new_version'   => $r->new_version,
			'url'           => $r->url,
			'package'       => $r->package,
			'tested'        => $r->tested,
			'requires'      => $r->requires,
			'requires_php'  => $r->requires_php,
			'upgrade_notice'=> isset( $r->upgrade_notice ) ? $r->upgrade_notice : '',
		);
		if ( version_compare( $this->version, $r->new_version, '<' ) ) {
			$transient->response[ $this->basename ] = $item;
		} else {
			$transient->no_update[ $this->basename ] = $item;
		}
		return $transient;
	}

	public function plugin_info( $result, $action, $args ) {
		if ( 'plugin_information' !== $action || empty( $args->slug ) || $args->slug !== $this->slug ) { return $result; }
		$r = $this->remote();
		if ( ! $r ) { return $result; }
		return (object) array(
			'name'          => $r->name,
			'slug'          => $r->slug,
			'version'       => $r->new_version,
			'tested'        => $r->tested,
			'requires'      => $r->requires,
			'requires_php'  => $r->requires_php,
			'last_updated'  => $r->last_updated,
			'homepage'      => $r->url,
			'download_link' => $r->package,
			'sections'      => (array) $r->sections,
		);
	}

	public function purge() { delete_transient( $this->cache_key ); }
}