Verify Item Purchases with the Envato API – Tutorial

Hello guys! I’m excited to be writing my debut article for WPEka, and today I’m going to be showing you how to quickly and easily create a highly useful PHP function which can verify Envato Purchase Codes for your items via Envato’s Marketplaces API.

For those of you who don’t know, for every item purchased on any of Envato’s marketplaces, a unique string of letters and numbers is generated which can be used to identify a single purchase. Purchase codes come in the following format (note that this example isn’t a valid code, just an example in the same format);


Being able to verify these codes is a very useful ability for authors to have, as if they are easily and accurately able to identify legitimate customers, they can afford to invest in more premium services, such as customer support forums, for example, confident their ‘customers’ have really bought their item.

Thankfully verification of these codes is very easy using the Marketplaces API. Today we will be looking at only one use of the API, but it does offer a great deal more functionality. For information on this, you can read my tutorial on its general usage on WPKube.com or read the official documentation.

Now we’ve got the introduction out of the way, let’s start looking at the nuts-and-bolts of what we will be doing.

Steps to verify Envato Purchase Codes using API


As we will be accessing the secure part of the API we will need a couple of things to successfully connect;

  • An API Key linked to your Envato Username (We will see how to create this in a minute)
  • A valid purchase code for one of your items (this is surprisingly hard to get – the only way to generate one is with a valid purchase of your item. I am using the purchase code of one of my customers for this tutorial.)

Getting an API Key

You can create an API Key from the ‘My Settings’ tab of your profile on any of the marketplaces. When on the ‘My Settings’ tab, choose the ‘API Keys’ menu item and you should see a screen similar to the image below.

Getting API key

You may not have an API key listed yet, which is fine. All you need to do is fill out the label field and click the ‘Generate API Key’ button.

Once you have you API Key, copy it and get ready for the next part – this is where the fun begins!

The Code

Right, now we should have everything we need for our function to work.

We will be using PHP’s cURL function to interact with the API – some servers have this module disabled, so if you have any problems check your server configuration (or with your webmaster/web host) to ensure it is enabled.

The URL we will be referencing in our function looks like this;


Note: Update the Code: The CURL Call Also Needs a User-Agent to get it working. 
Great! So with any further ado, let’s looks at the completed code.

function verify_envato_purchase_code($code_to_verify) {
	// Your Username
	$username = 'USERNAME';
	// Set API Key	
	$api_key = 'API KEY';
	// Open cURL channel
	$ch = curl_init();
	// Set cURL options
	curl_setopt($ch, CURLOPT_URL, "http://marketplace.envato.com/api/edge/". $username ."/". $api_key ."/verify-purchase:". $code_to_verify .".json");
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

       //Set the user agent
       $agent = 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)';
       curl_setopt($ch, CURLOPT_USERAGENT, $agent);	 
	// Decode returned JSON
	$output = json_decode(curl_exec($ch), true);
	// Close Channel
	// Return output
	return $output;

$purchase_key = 'PURCHASE KEY TO CHECK';

$purchase_data = verify_envato_purchase_code( $purchase_key );

if( isset($purchase_data['verify-purchase']['buyer']) ) {
	echo 'Valid License Key!Details'; 
        echo 'Item ID: ' . $purchase_data['verify-purchase']['item_id'] . ' ';
        echo 'Item Name: ' . $purchase_data['verify-purchase']['item_name'] . ' ';
        echo 'Buyer: ' . $purchase_data['verify-purchase']['buyer']. ' ';
        echo 'License: ' . $purchase_data['verify-purchase']['licence'] . ' ';
        echo 'Created At: ' . $purchase_data['verify-purchase']['created_at'] . ' ';        echo ''; 
} else{
    echo 'Invalid license key.';

Ok then, let’s break the above code down to see what is actually going on.

On line 2 you see we are creating our verify_envato_purchase_code() function, which accepts only a single parameter, the purchase code to be checked: I have defined the username and API Key within the function itself as these should be treated as constants, hence passing them through the function interface is a redundant gesture.

The rest of the setup is pretty typical. Notice how I have stored the API Key and Username in corresponding variables, which I use to populate the variable parts of the URL I have detailed above.

If we look at what our function actually returns by printing it to the screen, you will see something similar to the following;

    [verify-purchase] => Array
            [item_name] => TCWP – Supercharged Twitter Card Management for WP
            [item_id] => 5850316
            [created_at] => Sat Apr 05 20:35:15 +1100 2014
            [buyer] => BUYER_USERNAME
            [licence] => Regular License


Notice how the data is returned as an array within an array. This is something you need to take into account when referencing the data.

If we look back at our original function, you will be able to see how by checking the existence of one of the pieces of data you can check that the code verification was successful; if the code is invalid it doesn’t return any data. Using this logic we can derive the following boolean check;

if( isset($purchase_data['verify-purchase']['buyer']) ) {
else {

With this, we have all we need to empirically verify Envato purchase codes. The function I have provided for you here is only a simple application of what this functionality can be used to achieve and I would love to hear your ideas about potential applications and/or how you have used this in your own code.

I hope you have found this article useful. If you have any questions, you can leave them in the comment section below or you can tweet me personally @harribellthomas.


  1. James Bridges

    May 30, 2014 at 3:52 pm

    Thanks for this! Very useful 🙂


  2. Richard Bland

    March 19, 2015 at 4:28 pm

    So am I right in saying that with this I could add in a simple command that says if valid purchase redirect URL to xyz.html page, if not display this xyzerro.html page?


    • Harri Bell-Thomas

      March 21, 2015 at 12:35 am

      Hello Richard,
      Yes this is completely possible and quite a normal use for this kind of functionality. It could also be used to only allow a person to create an account on your site if they have a valid purchase.
      Thanks, Harri


  3. Pragya

    March 20, 2015 at 5:47 pm

    Glad you liked it! 🙂


  4. Stéphane Paton

    April 28, 2015 at 2:03 am


    I think it’s a new rule, but Envato asks to set a user-agent on each API Call. When using your php code, I get this message :

    > All API requests require a user agent to be set

    Just add this line when creating your cURL request :

    > curl_setopt($ch, CURLOPT_USERAGENT, ‘API’);

    and it works like a charm! Thanks a lot for this article.


  5. Berend

    August 7, 2015 at 10:24 pm

    Thanks for this custom implementation. The official PHP wrapper of the Envato API kept returning “false” and isn’t kept up to date apparently.


  6. Tony

    July 22, 2016 at 10:12 am

    Great! I was looking for this for a day to build a license-checker for my WordPress plugin.


  7. Amar

    August 1, 2016 at 3:19 pm

    I’ve a question about purchase code used in Envanto products,
    I already bought a plugin from there and it ask me the purchase code, It’s ok for now, but the problem is that I need to try it in another hosting before applying in my official website, does it expired if I use it many times??
    and how to verify this option?


  8. Rakesh

    October 4, 2016 at 1:04 am

    Hey Great article, I want to ask that will it also applicable for multi purchase? Like if buyer order 3 wp plugin via codecanyon, the code detect how many plugin has been brought and activate all of them?


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Join Over 50,000+ Subscribers

Interested In