The flow
1. Customer pays via PayPal
2. A license key is generated and emailed
3. The key activates on their domain
The storage
Licenses live in a SQLite table:
CREATE TABLE licenses (
id INTEGER PRIMARY KEY,
license_key TEXT UNIQUE,
product TEXT,
status TEXT,
max_activations INTEGER
);
Verification
The script calls the API with its key and domain:
$lic = $pdo->prepare("SELECT * FROM licenses WHERE license_key = ?");
$lic->execute([$key]);
No domain match for the key? Activation is rejected. Simple, stateless, hard to abuse.