License API

The License API lets you programmatically issue new license tokens and refresh existing ones. These endpoints are typically called by the Pageflare CLI during pageflare login and pageflare token refresh, but you can call them directly when building integrations.

Base URL

https://pageflare.dev/_api

All license endpoints require an Authorization: Bearer <your-token> header. See Authentication for details.

Token format

License tokens are signed JWTs. They encode your account identity, license tier, and an expiration time. The CLI and API validate the signature on every request — you do not need to inspect the payload yourself.

A decoded token payload looks like this:

{
  "sub": "user_abc123",
  "email": "user@example.com",
  "tier": "pro",
  "features": ["spa_mode", "adaptive_sizing", "critical_css"],
  "valid_until": "2027-03-12T00:00:00.000Z",
  "iat": 1741776000,
  "exp": 1773312000
}

Claim	Description
`sub`	Your Pageflare user ID
`email`	Email address linked to the account
`tier`	License tier: `free`, `pro`, or `team`
`features`	Array of Pro/Team features enabled on this token
`valid_until`	License expiry (subscription end date)
`exp`	JWT expiry — refresh before this timestamp

POST /license/issue

Issue a new license token for the authenticated account. Use this to generate a token when setting up a new machine or CI environment.

Request

POST /_api/license/issue
Authorization: Bearer <your-token>

No request body is required.

Response

200 OK

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Store the returned token securely. The CLI writes it to ~/.config/pageflare/credentials.json. In CI, store it as a secret environment variable and pass it via the PAGEFLARE_TOKEN environment variable or the --token flag.

Try it

POST/license/issue

Request

Response

Click Send to make a request

Errors

Status	Meaning
`401 Unauthorized`	Invalid or missing token
`403 Forbidden`	Account does not have an active license

GET /license/refresh

Refresh an existing license token before it expires. This returns a new token with a refreshed expiry — the old token remains valid until its exp claim is reached.

Request

GET /_api/license/refresh
Authorization: Bearer <your-token>

Response

200 OK

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Replace any stored copy of the old token with the new one.

Try it

GET/license/refresh

Request

Response

Click Send to make a request

Errors

Status	Meaning
`401 Unauthorized`	Invalid or missing token
`403 Forbidden`	License is expired or has been revoked

Using tokens in CI

Set the token as a secret in your CI environment and reference it via the environment variable PAGEFLARE_TOKEN:

# GitHub Actions example
- name: Optimize site
  env:
    PAGEFLARE_TOKEN: ${{ secrets.PAGEFLARE_TOKEN }}
  run: pageflare dist/ --output dist/

When PAGEFLARE_TOKEN is set, the CLI skips the credential file and uses the environment variable directly. This is the recommended approach for CI pipelines — do not commit tokens to source control.

To generate a long-lived CI token:

pageflare token issue

This calls POST /license/issue and prints the token. Copy the output and store it as a CI secret.