Skip to main content
Avalex includes native support for BuiltByBit’s External License Key Placeholders. When a buyer downloads your resource on BuiltByBit, BuiltByBit automatically sends a webhook request to your Avalex server. Avalex securely generates or retrieves the buyer’s license key and responds immediately — allowing BuiltByBit to inject the license key directly into the downloaded file before delivery.

​
How It Works

  1. Secret Verification: When BuiltByBit calls your webhook, it includes a configured shared secret. Avalex compares this with the secret defined in your backend configuration.
  2. Product Matching: Avalex matches the incoming resource_id against the BuiltByBit Resource ID set on your products.
  3. Customer Resolution: Avalex checks if a customer with the buyer’s BuiltByBit ID (socials.BuiltByBitID) already exists:
    • Existing customer: The license is assigned directly to them.
    • New customer: A new customer profile is automatically created using their BuiltByBit User ID (and Steam ID if available).
  4. Double-License Prevention (Idempotent): If the buyer already holds an active, non-expired license for that product, Avalex re-returns the existing license key without generating unnecessary duplicate licenses or orders.
  5. Automated Order & License Creation: If the buyer has no active license, Avalex generates a new license key (inheriting IP and HWID slot limits and subscription duration from the product) and creates an order record.
  6. Instant Plain Text Delivery: Avalex returns only the license key string as plain text (text/plain), which BuiltByBit embeds at your placeholder’s token location.

​
Step-by-Step Setup

1

Configure your BuiltByBit Secret in Avalex

In your server configuration (application.conf or environment variable BUILTBYBIT_SECRET), set a strong secret token:
Or set the environment variable:
2

Map BuiltByBit Resource ID to your Product

Open the Avalex Admin Portal, navigate to Products, edit or create the product you are selling, and set the BuiltByBit Resource ID (e.g. 98765).
3

Create a Placeholder on BuiltByBit

  1. Log in to BuiltByBit and go to your resource management dashboard.
  2. Navigate to Placeholders (builtbybit.com/placeholders/).
  3. Click Create Placeholder and set the Type to External license key.
  4. Set the Server URL to your Avalex public endpoint:
  5. Enter the exact Secret you configured in Step 1.
4

Add the Placeholder Token to your Resource Files

Drop the placeholder token provided by BuiltByBit (e.g. %%__LICENSE_KEY__%% or your custom token) inside your plugin configuration, source code, or licensing files.

​
Webhook Request Specifications

BuiltByBit sends an HTTP POST request with form data (application/x-www-form-urlencoded or multipart/form-data) containing:

​
Response Format

Avalex responds with 200 OK and Content-Type text/plain; charset=UTF-8:
Whatever string Avalex returns is inserted directly at the placeholder’s location in the downloaded file.

​
Security & Reliability Features

  • Rate Limiting: The endpoint is protected with a rate limiter allowing up to 60 requests per minute per IP.
  • Audit Logging: Every issuance (builtbybit.license.create), reuse (builtbybit.license.reuse), and rejection (builtbybit.license.reject) is recorded in the Avalex audit log with the associated user ID and resource ID.
  • Automatic Fallback Protection: If the secret is missing or misconfigured on the server, requests are automatically rejected to prevent unauthorized license generation.