Trigger CI/CD Pipelines After a License Purchase

If you sell on-premise software, every license purchase can trigger a custom build. When a customer buys a license, your CI/CD pipeline automatically builds a branded binary and delivers it. Here's how to wire Keymint's license.created webhook to GitHub Actions.

How It Works

1. Your backend creates a license via admin.createKey() after Stripe payment
2. Keymint emits license.created webhook
3. Your handler verifies the signature, extracts the license data
4. Your handler calls the GitHub API to trigger a repository_dispatch
5. A GitHub Actions workflow builds, packages, and uploads the artifact

Setup

Keymint: Subscribe to license.created via Dashboard → Developer → Webhooks.

GitHub: Create a Personal Access Token with repo scope.

The Dispatch Handler

const event = JSON.parse(payload);

if (event.type === 'license.created') {
  await fetch(
    `https://api.github.com/repos/${GITHUB_OWNER}/${GITHUB_REPO}/dispatches`,
    {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${process.env.GITHUB_TOKEN}`,
        'Accept': 'application/vnd.github.v3+json',
      },
      body: JSON.stringify({
        event_type: 'license-created',
        client_payload: {
          product_id: event.data?.license?.productId,
          license_type: event.data?.license?.licenseType,
          customer_email: event.data?.license?.customerEmail,
          organization_id: event.organization_id,
        },
      }),
    },
  );
}

GitHub Actions Workflow

name: Build on License Purchase
on:
  repository_dispatch:
    types: [license-created]
jobs:
  build:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
        env:
          CUSTOMER_EMAIL: ${{ github.event.client_payload.customer_email }}
      - uses: actions/upload-artifact@v4
        with:
          name: build-${{ matrix.os }}
          path: dist/

Notify the customer when the build completes with a download link.

Variations

• Vercel deploy: POST to a Vercel deploy hook URL instead of GitHub dispatch
• Docker build: trigger a Docker Hub automated build with customer-specific tags
• Multi-tenant SaaS: use the webhook to provision a new environment per customer

Security

• Always verify the Keymint-Signature HMAC before triggering builds — builds cost compute
• Store CI/CD tokens as environment variables, never in code
• Rate-limit build triggers to prevent abuse from a leaked admin API key

Full webhook docs: keymint.dev/docs/topics/webhooks