---
title: "Redeem License"
method: POST
path: "/api/license/redeem"
---

# Redeem License

`POST /api/license/redeem`

## Request

- Base URL: `https://www.conceptio.app` (the document declares no server; this is the origin it was published from)
- URL: `https://www.conceptio.app/api/license/redeem`
- Auth: none declared

Redeem a one-time license key, and bind it to the account when we know it.

Two writes, one act. `licenses/{key}.redeemed_by` is the one-time record
(claimed inside an optimistic Firestore transaction — check and claim are
one atomic step, so a concurrent second redeem 409s instead of binding the
paid key twice); `users/{uid}.licenseKey` is the bind `_get_tier` reads on the
Bearer path, so a redeemed license elevates every later request from that
account with no ``X-License-Key`` header. `Authorization: Bearer <idToken>`
is therefore how a non-browser client (CLI, agent, script) redeems without
ever opening the SPA.

Three deliberate rules, each one a way the bind would otherwise not happen
or could not be revoked:

* **The verified uid outranks the body's ``principal``.** A token is proof;
  a body field is a claim. Using the proof for the one-time record too keeps
  redemption and bind naming the same account.
* **An ``anon:`` redemption can be displaced by a verified caller.** Those
  principals are User-Agent slices the client invents, so they prove nothing
  and cannot own a license against an account — which is what a visitor who
  redeems before signing in, then signs in, would otherwise be stuck with.
  A real principal (a uid, an operator-chosen string) stays immutable.
* **Fail-open on the bind.** The license is already redeemed by then; a
  Firestore hiccup returns ``bound: false``, never a 500.

## Headers

- `authorization` string, nullable
- `x-license-key` string, nullable
- `x-principal` string, nullable
- `x-api-key` string, nullable

## Request body

- LicenseRedeemIn
  - `key` string
  - `principal` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/conceptio/apis/conceptio-open-knowledge-api.md) · [All operations](https://skmtc.dev/conceptio/apis/conceptio-open-knowledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/conceptio/apis/conceptio-open-knowledge-api/revisions/eb73efec13b4?raw)