Commerce API Reference

LauncherForge Commerce API lets a server-side store integration generate a game key after the store has confirmed a purchase.

LauncherForge does not charge the buyer. WooCommerce, PrestaShop, your custom website, or the payment gateway processes the payment. LauncherForge only generates and returns the game key.

How the flow works

Buyer completes payment
        ↓
The store confirms the order
        ↓
The store server calls LauncherForge
        ↓
LauncherForge generates a game key
        ↓
The store saves the key in the order
        ↓
WooCommerce or the store sends the key to the buyer

Before you start

You need:

A paid LauncherForge plan with the Commerce API add-on active.
A complete Commerce API key.
A game owned by the same workspace.
CD-Key protection enabled for that game.
The numeric LauncherForge App ID.
A server-side integration. Never call Commerce API from public browser JavaScript.

A value such as lf_commerce_live_d122d2cc091f is only the visible key prefix. It cannot authenticate requests. The complete key is shown only once when it is generated or regenerated.

Base URL

https://backend.launcherforge.io/api/v1

The current stable delivery endpoint is:

POST /external/commerce/deliveries

Full URL:

https://backend.launcherforge.io/api/v1/external/commerce/deliveries

Authentication

Send the complete Commerce API key as a Bearer token:

Authorization: Bearer YOUR_COMPLETE_COMMERCE_API_KEY

Never place the key in:

Browser JavaScript.
HTML.
Mobile apps.
Public repositories.
Screenshots.
Client-visible logs.

Idempotency

Every delivery request must include:

Idempotency-Key: <stable-unique-operation-id>

The value must identify one exact purchased unit. Retrying the same operation with the same value returns the previous delivery instead of generating another key. Recommended format:

<provider>:<store-id>:<order-id>:<order-item-id>:<unit>

WooCommerce example:

wc:40c19d4c0ed64ca1:1001:72:1

If quantity is three, send three delivery requests with different unit values:

wc:40c19d4c0ed64ca1:1001:72:1
wc:40c19d4c0ed64ca1:1001:72:2
wc:40c19d4c0ed64ca1:1001:72:3

When a request is repeated with the same Idempotency-Key, the response contains alreadyProcessed: true and returns the same game key.

Create a delivery

POST /external/commerce/deliveries

Headers

Header	Required	Value
`Authorization`	Yes	`Bearer <complete-commerce-api-key>`
`Idempotency-Key`	Yes	Stable unique ID for this purchased unit
`Content-Type`	Yes	`application/json`
`Accept`	Recommended	`application/json`

Request body

Field	Type	Required	Description
`appId`	integer	Yes	Numeric LauncherForge App ID.
`externalOrderId`	string	Yes	Order ID in the external store.
`externalOrderItemId`	string	No	Order line or unit ID.
`customerEmail`	string	No	Buyer email address.
`customerName`	string	No	Buyer name.
`provider`	string	No	`CUSTOM`, `WOOCOMMERCE`, or `NATIVE_APP`.
`expiresAt`	ISO 8601 string	No	Optional future expiration date.
`note`	string	No	Internal reference for the generated key.

Recommended request

{
  "appId": 1,
  "externalOrderId": "1001",
  "externalOrderItemId": "72:1",
  "customerEmail": "buyer@example.com",
  "customerName": "Example Buyer",
  "provider": "WOOCOMMERCE",
  "note": "WooCommerce order 1001, item 72, unit 1"
}

cURL example

curl --request POST \
  --url "https://backend.launcherforge.io/api/v1/external/commerce/deliveries" \
  --header "Authorization: Bearer YOUR_COMPLETE_COMMERCE_API_KEY" \
  --header "Idempotency-Key: custom-store:1001:1:1" \
  --header "Content-Type: application/json" \
  --data '{
    "appId": 1,
    "externalOrderId": "1001",
    "externalOrderItemId": "1",
    "customerEmail": "buyer@example.com",
    "customerName": "Example Buyer",
    "provider": "CUSTOM"
  }'

PowerShell example

$commerceKey = "YOUR_COMPLETE_COMMERCE_API_KEY"

$headers = @{
    Authorization     = "Bearer $commerceKey"
    "Idempotency-Key" = "custom-store:1001:1:1"
}

$body = @{
    appId                = 1
    externalOrderId      = "1001"
    externalOrderItemId  = "1"
    customerEmail        = "buyer@example.com"
    customerName         = "Example Buyer"
    provider             = "CUSTOM"
} | ConvertTo-Json

$response = Invoke-RestMethod `
    -Method Post `
    -Uri "https://backend.launcherforge.io/api/v1/external/commerce/deliveries" `
    -Headers $headers `
    -ContentType "application/json" `
    -Body $body

$response | ConvertTo-Json -Depth 10

Successful response

{
  "success": true,
  "data": {
    "deliveryId": "dlv_98c0b1c0dae6ec7376597758",
    "alreadyProcessed": false,
    "provider": "CUSTOM",
    "externalOrderId": "1001",
    "externalOrderItemId": "1",
    "customerEmail": "buyer@example.com",
    "status": "GENERATED",
    "game": {
      "id": 1,
      "slug": "cs-1-6",
      "name": "CS 1.6"
    },
    "gameKey": {
      "key": "A0622-F4BF7-00204",
      "status": "ACTIVE",
      "expiresAt": null,
      "generatedAt": "2026-08-01T03:29:50.422Z"
    },
    "createdAt": "2026-08-01T03:29:50.431Z"
  }
}

Response fields

Field	Meaning
`deliveryId`	Stable LauncherForge delivery identifier.
`alreadyProcessed`	`true` when the idempotent operation already existed.
`status`	Current delivery status.
`gameKey.key`	The game key to deliver to the buyer.
`gameKey.status`	Current key status.
`gameKey.expiresAt`	Expiration date or `null`.

Common errors

`INVALID_COMMERCE_API_KEY`

The Bearer token is invalid, revoked, incomplete, or only contains the visible prefix.

`COMMERCE_API_NOT_ENABLED`

The Commerce API add-on is not active for the workspace.

`EXTERNAL_GAME_NOT_AVAILABLE`

One of these conditions failed:

The App ID does not exist.
The game belongs to another workspace.
The game is not linked correctly.
CD-Key protection is disabled.

`IDEMPOTENCY_KEY_REQUIRED`

The Idempotency-Key header is missing.

Validation error

The request body contains an invalid field, type, or value.

Who sends the email?

LauncherForge backend returns the generated key to the authenticated store integration. It does not email the buyer for external Commerce API deliveries. The external store is responsible for delivery:

The WooCommerce plugin inserts the key into customer order emails.
It also shows the key in My Account → Orders.
A custom store must send or display the key using its own email and order system.

Security checklist

Store the complete key only on the server.
Use HTTPS.
Rotate the key after accidental exposure.
Never log Bearer tokens.
Never expose the key in frontend code.
Use one deterministic idempotency key per purchased unit.
Verify that payment is complete before requesting a game key.
Do not generate a new idempotency key merely because a request timed out.

​Commerce API Reference

​How the flow works

​Before you start

​Base URL

​Authentication

​Idempotency

​Create a delivery

​Headers

​Request body

​Recommended request

​cURL example

​PowerShell example

​Successful response

​Response fields

​Common errors

​INVALID_COMMERCE_API_KEY

​COMMERCE_API_NOT_ENABLED

​EXTERNAL_GAME_NOT_AVAILABLE

​IDEMPOTENCY_KEY_REQUIRED

​Validation error

​Who sends the email?

​Security checklist

Commerce API Reference

How the flow works

Before you start

Base URL

Authentication

Idempotency

Create a delivery

Headers

Request body

Recommended request

cURL example

PowerShell example

Successful response

Response fields

Common errors

`INVALID_COMMERCE_API_KEY`

`COMMERCE_API_NOT_ENABLED`

`EXTERNAL_GAME_NOT_AVAILABLE`

`IDEMPOTENCY_KEY_REQUIRED`

Validation error

Who sends the email?

Security checklist