How it works

Lizen is a REST API that runs on Cloudflare’s global edge network. Here’s how the core flows work.

The validation path

When your app calls POST /v1/validate, this is what happens:

Your app (anywhere)
  → Cloudflare edge PoP (nearest, <10ms)
    → KV edge cache check
      → If hit:  return cached result instantly
      → If miss: query D1 (SQLite), populate cache, return result

The KV cache has a 60-second TTL. Revocations bypass the TTL — the cache is invalidated synchronously when a key is revoked.

Key lifecycle

Create key (POST /v1/keys)
  → status: active
  → Validate calls succeed

Revoke key (POST /v1/keys/:id/revoke)
  → status: revoked
  → KV cache cleared immediately
  → All subsequent validate calls return { valid: false, reason: 'revoked' }

Expire key (automatic, cron at 02:00 UTC)
  → status: expired
  → Validate calls return { valid: false, reason: 'expired' }

Activation tracking

Each validation call records the device fingerprint. If the fingerprint is new:

A new activation record is created linking the key to the device.
The activation count increments.
If activationsUsed >= activationLimit, subsequent validations from new devices return activation_limit.

The same device re-validating does not consume an additional activation seat.

API key vs license key

Two distinct concepts:

	API key	License key
Who uses it	You (the developer)	Your customers
Format	`lz_[32 chars]`	`MYAPP-XXXX-XXXX-XXXX` (customisable)
Purpose	Authenticate API calls	Prove purchase of your software
Stored	SHA-256 hash only	Plaintext (for validation lookup) + SHA-256 hash
Secret	Yes — keep server-side	No — customers enter it manually

Rate limits

All API calls (/v1/*) count against a per-account daily limit, tracked in Cloudflare KV:

Plan	Calls/day
Free	500
Hobby	10,000
Starter	50,000
Growth	200,000
Enterprise	Unlimited

The counter resets at midnight UTC.