The Keystation API.

curl https://keysystem.nabzclan.vip/api/v1/me \
  -H "x-project: p_arctic_fox_92"

{
  "ok": true,
  "project_id": "p_arctic_fox_92",
  "name": "Arctic Fox Hub",
  "type": "script",
  "is_active": true
}

# kss_ token with keys:read — can list and inspect, cannot generate
curl "https://keysystem.nabzclan.vip/api/v1/keys?status=active" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer kss_<your_scoped_token>"

# kss_ token with keys:write — can generate and edit, cannot revoke
curl -X POST "https://keysystem.nabzclan.vip/api/v1/keys/generate" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer kss_<your_scoped_token>" \
  -H "Content-Type: application/json" \
  -d '{"count": 5, "label": "batch-june"}'

{
  "key": "KS-7H2P-VLNX-9KJ4",
  "hwid": "first-time-seen-device-id",      // script surfaces
  "machine_id": "fingerprint-string"        // license surfaces
}

curl -X POST https://keysystem.nabzclan.vip/api/v1/keys/validate \
  -H "x-project: p_arctic_fox_92" \
  -H "Content-Type: application/json" \
  -d '{"key":"KS-7H2P-VLNX-9KJ4","hwid":"7a3f2e9b"}'

{
  "ok": true,
  "valid": true,
  "key_id": "k_xxxxxxxxxxxx",
  "type": "script",
  "expires_at": "2026-05-19T07:34:12.000Z",
  "scopes": [],
  "metadata": null
}

{
  "ok": true,
  "valid": false,
  "reason": "hwid_mismatch"
}

curl -X POST https://keysystem.nabzclan.vip/api/v1/keys/generate \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "count": 5,
    "label": "promo-friday",
    "ttl_minutes": 10080,
    "scopes": ["read", "write"],
    "rate_limit_per_minute": 60
  }'

{
  "ok": true,
  "count": 5,
  "keys": [
    { "id": "k_a1b2c3", "key": "KS-7H2P-VLNX-9KJ4", "expires_at": "2026-06-01T00:00:00Z" },
    { "id": "k_d4e5f6", "key": "KS-G8XX-LM34-ZZ91", "expires_at": "2026-06-01T00:00:00Z" }
  ]
}

# Page 1, 20 per page
curl "https://keysystem.nabzclan.vip/api/v1/keys?page=1&limit=20" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>"

# Only active keys, page 2
curl "https://keysystem.nabzclan.vip/api/v1/keys?status=active&page=2&limit=50" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>"

{
  "ok": true,
  "keys": [
    {
      "key": "KS-7H2P-VLNX-9KJ4",
      "id": "k_xxxxxxxxxxxx",
      "status": "active",
      "label": "giveaway-batch",
      "hwid": null,
      "machine_ids": [],
      "max_activations": null,
      "current_activations": 0,
      "scopes": [],
      "rate_limit_per_minute": null,
      "current_uses": 42,
      "max_uses": null,
      "expires_at": "2026-12-31T00:00:00.000Z",
      "last_used_at": "2026-05-14T10:00:00.000Z",
      "last_used_ip": "1.2.3.4",
      "created_at": "2026-05-01T00:00:00.000Z"
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 150,
    "pages": 8,
    "has_next": true,
    "has_prev": false
  }
}

# Add 30 days to existing expiry — safe renewal, never shortens
curl -X PATCH "https://keysystem.nabzclan.vip/api/v1/keys/KS-7H2P-VLNX-9KJ4" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>" \
  -H "Content-Type: application/json" \
  -d '{"extend_minutes": 43200}'

# Set an absolute expiry date
curl -X PATCH "https://keysystem.nabzclan.vip/api/v1/keys/KS-7H2P-VLNX-9KJ4" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "customer-alice-renewed",
    "expires_at": "2027-01-01T00:00:00Z"
  }'

# Set expiry from now (replaces current expiry — use extend_minutes to add instead)
curl -X PATCH "https://keysystem.nabzclan.vip/api/v1/keys/KS-7H2P-VLNX-9KJ4" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>" \
  -H "Content-Type: application/json" \
  -d '{"ttl_minutes": 10080}'

# Remove expiry entirely — make perpetual
curl -X PATCH "https://keysystem.nabzclan.vip/api/v1/keys/KS-7H2P-VLNX-9KJ4" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>" \
  -H "Content-Type: application/json" \
  -d '{"ttl_minutes": 0}'

# Pause a key
curl -X PATCH "https://keysystem.nabzclan.vip/api/v1/keys/KS-7H2P-VLNX-9KJ4" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>" \
  -H "Content-Type: application/json" \
  -d '{"status": "paused"}'

# Clear HWID binding (let key re-bind to a new device)
curl -X PATCH "https://keysystem.nabzclan.vip/api/v1/keys/KS-7H2P-VLNX-9KJ4" \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>" \
  -H "Content-Type: application/json" \
  -d '{"hwid": null}'

{
  "ok": true,
  "key": "KS-7H2P-VLNX-9KJ4",
  "id": "k_xxxxxxxxxxxx",
  "updated": ["expires_at"]
}

curl -X POST https://keysystem.nabzclan.vip/api/v1/keys/revoke \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>" \
  -H "Content-Type: application/json" \
  -d '{"key": "KS-7H2P-VLNX-9KJ4"}'

curl https://keysystem.nabzclan.vip/api/v1/keys/KS-7H2P-VLNX-9KJ4 \
  -H "x-project: p_arctic_fox_92" \
  -H "Authorization: Bearer <api_secret>"

curl -X POST https://keysystem.nabzclan.vip/api/v1/checkpoints/complete \
  -H "x-project: p_arctic_fox_92" \
  -H "Content-Type: application/json" \
  -d '{"key":"KS-7H2P-VLNX-9KJ4","checkpoint":"step-1-linkvertise"}'

curl -X POST https://keysystem.nabzclan.vip/api/v1/license/activate \
  -H "x-project: p_arctic_fox_92" \
  -H "Content-Type: application/json" \
  -d '{"key":"ABCD-EFGH-IJKL-MNOP-QRST","machine_id":"fp-string","machine_name":"Dell-XPS-13"}'

curl -X POST https://keysystem.nabzclan.vip/api/v1/license/deactivate \
  -H "x-project: p_arctic_fox_92" \
  -H "Content-Type: application/json" \
  -d '{"key":"ABCD-EFGH-IJKL-MNOP-QRST","machine_id":"fp-string"}'

curl -X POST https://keysystem.nabzclan.vip/api/v1/obfuscate \
  -H "Authorization: Bearer kss_<your_api_token>" \
  -F "[email protected]" \
  -F "strength=high" \
  -F "encrypt_strings=true" \
  -o obfuscated_script.lua

{
  "event":   "key.validated",
  "sent_at": "2026-05-14T10:23:01.124Z",
  "data":    { "key_id": "k_abc123", "ip": "1.2.3.4" }
}

import crypto from "node:crypto";

// Use express.raw() so the body bytes are unmodified
app.use("/webhooks", express.raw({ type: "application/json" }));

export function verifyWebhook(rawBody: Buffer, header: string, secret: string): boolean {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  try {
    return crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
  } catch {
    return false; // length mismatch → reject
  }
}

import hmac, hashlib

def verify_webhook(raw_body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(header, expected)

# FastAPI / Starlette: use await request.body() — do NOT parse JSON first

<?php
$secret    = getenv('KEYSTATION_WEBHOOK_SECRET');
$rawBody   = file_get_contents('php://input');
$sigHeader = $_SERVER['HTTP_X_KEYSTATION_SIGNATURE'] ?? '';

$expected  = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);

if (!hash_equals($expected, $sigHeader)) {
    http_response_code(401);
    exit(json_encode(['error' => 'Bad signature']));
}

$payload = json_decode($rawBody, true);