License API

Keys look like STV-7KQM-2HXP-W9RT-EB4N. No zeros, ones, O's, I's or L's, so you can read them out loud.

Find yours in your account. For the everyday version, read Licensing and your server. The server itself is free and needs no key. A key is a Stavo 1 Apps license for the native apps, with every 1.x update. Family (6 people) and Community (25) keys go in your server's Instance page. A Personal key belongs to one person: add it in Profile on any Stavo server. The first server and user to check it binds it; moving to another server rebinds it for free, once a week at most. Paid keys never expire. The apps never take a key themselves, they follow your server. Your account page shows every server that checked in.

Validate API

POST /api/v1/licenses/validate. CORS is open, it's rate limited per IP.

curl -s https://stavo.nulldaily.com/api/v1/licenses/validate \
  -H 'content-type: application/json' \
  -d '{"key":"STV-XXXX-XXXX-XXXX-XXXX","product":"server","instance":"https://drive.example.com","person":"<per-user hash>"}'

{ "valid": true, "plan": "household", "seats": 6, "major": 1, "kind": "apps",
  "status": "active", "expires_at": null,
  "features": ["server", "annotate", "gif", "branding"],
  "email_hint": "a****@example.com" }

major is the major version the key covers (every key so far is Stavo 1, including the original $25 ones, which count as Family), seats is how many people it covers (1, 6 or 25) and kind is "apps": keys unlock the native apps, the server is free. The plan id for Family is still household. Personal keys also return person, a stable hash of who owns the key; send person (a per-user hash) with them. A server accepts a key when major is at least its own major version; 0.x builds count as 1.

Invalid keys still return 200 with { "valid": false, "reason": "not_found" | "expired" | "revoked" }. A Personal key that moved servers less than 7 days ago returns { "valid": false, "reason": "bound_elsewhere", "rebind_after": "<iso>" }.