Remote Provisioning API Guide

Remote Provisioning connects LiteShoper checkout to your own API. When buyers pay, LiteShoper sends a signed HTTP job to create or renew remote access. When billing stops, cancels, or full refunds happen, it sends suspend, terminate, or revoke. Credentials from your response (or webhook) can appear on the buyer’s order page.

What you need

The Remote Provisioning plugin installed and activated
A remote HTTPS API that accepts JSON
HMAC (recommended) or Bearer auth matching your Endpoint settings
Cron every 5–15 minutes (Bearer token on the plugin Settings page)

Quick setup

Endpoints — add base URL + secrets. Use Test connection (/ping) and check the popup before saving.
Product — open the Remote Provisioning tab: enable, pick endpoint, subscription or permanent, paths, JSON templates, delivery field map.
Subscriptions — also enable LiteShoper subscription billing if you sell renewals.
Settings — schedule cron; copy inbound webhook URL/secret if you use async replies.
API Docs — full contract lives in admin: Plugins → Remote Provisioning → API Docs.

Events LiteShoper sends

provision — first paid delivery
renew — renewal payment / resume after suspend
suspend — past billing date + grace days
terminate — cancelled or suspended too long
revoke — full (near-full) refund
test — admin Test connection only (do not create paid resources)

Outbound request (LiteShoper → you)

LiteShoper POSTs JSON to {base_url}{path} with headers including X-RP-Timestamp, X-RP-Event, optional Authorization: Bearer, and HMAC:

canonical = timestamp + "\n" + METHOD + "\n" + path + "\n" + raw_body
X-RP-Signature: sha256={HMAC_SHA256(canonical, secret)}

Return HTTP 2xx JSON. Include remote_ref and any fields you map for the buyer. For async work:

{"ok":true,"async":true,"status":"provisioning","remote_ref":"job_55"}

Always honor idempotency_key so retries do not double-create accounts.

Inbound webhook (you → LiteShoper)

POST /remote-provisioning/webhook with:

Authorization: Bearer {inbound_secret} (global or per-endpoint)
X-RP-Timestamp (unix, ±5 minutes)
X-RP-Signature: sha256=HMAC(timestamp + "\n" + raw_body)

{
  "event_id": "unique-once-id",
  "delivery_id": 12,
  "event": "provision",
  "remote_ref": "acc_123",
  "username": "buyer1",
  "password": "secret"
}

Query-string tokens are rejected. Duplicate event_id is ignored. Webhooks do not advance billing — only paid jobs do.

Buyer experience

Mapped credentials show under Access details on the account order page while the delivery is active/provisioning/suspended. Terminated access hides buyer credentials.

Local example

Plugin ships examples/example-remote-server.php. Run it, point an endpoint at it, enable private/localhost URLs for lab only, match the HMAC secret, then Test connection.

For headers, placeholders, security checklist, and curl samples, use the in-plugin API Docs after install.

← All docs