KEYMINT

post/key/checkout

Checkout Floating Session

Check out a concurrent seat for a floating license session.

Authentication required: Bearer Token in Authorization header.

Parameters

Idempotency-Key

string (header)

Client-generated unique key making a mutating request idempotent. Replaying a request with the same key returns the original result instead of duplicating side effects. Optional on POST/PUT/PATCH/DELETE.

e.g. <IDEMPOTENCY-KEY>

Request Body (application/json)

productIdrequired

string

Unique Product ID

licenseKeyrequired

string

The License Key to check out

hostIdrequired

string

Unique Host/Device Identifier

deviceTag

string

Optional human-readable label for the device

userIdentifier

string

Optional unique user identifier for audits

timestamp

string

Optional — required when EXTENDING an existing active session for this hostId: the session's current nextNonce (from the previous checkout/heartbeat response).

signature

string

Optional — required when EXTENDING an existing active session: HMAC-SHA256(sessionSecret, "<sessionId>:<timestamp>") using the session secret from the previous checkout. Proves possession of the session before the nonce is rotated and the sessionSecret is returned.

Responses

200Seat checked out successfully

403Limit reached or forbidden

Response Body (200)

code

integer

message

string

sessionId

string

sessionSecret

string

A temporary cryptographic secret returned on checkout, used by the client to sign subsequent heartbeat and checkin requests.

nextNonce

string

The initial rotating cryptographic nonce generated by the server. Must be passed in the subsequent heartbeat or checkin request as the timestamp parameter.

expiresAt

string

heartbeatInterval

integer

metadata

object

Arbitrary key-value pairs assigned to the license

currentSessions

integer

maxSessions

integer

licenseeName

string (nullable)

licenseeEmail

string (nullable)

Request Example

curl -X POST "https://api.keymint.dev/key/checkout" \
  -H "Authorization: Bearer <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
  "productId": "string",
  "licenseKey": "XXXXX-XXXXX-XXXXX-XXXXX",
  "hostId": "string",
  "deviceTag": "string",
  "userIdentifier": "string",
  "timestamp": "string",
  "signature": "string"
}'

Response (200 OK)

{
  "code": 0,
  "message": "string",
  "sessionId": "abc123sessionid22chars",
  "sessionSecret": "string",
  "nextNonce": "1700000000000",
  "expiresAt": "2026-08-28T05:22:46.510Z",
  "heartbeatInterval": 1,
  "metadata": {},
  "currentSessions": 1,
  "maxSessions": 1,
  "licenseeName": "string",
  "licenseeEmail": "user@example.com"
}