# feat.press authentication

feat.press authentication is split into public reads and merchant-server calls.

## Public routes

Marketplace reads and license verification do not require an API key.

## App API keys

Merchant-server calls (entitlement lookup, cancel, resume) use the product-scoped feat.press app API key:

`Authorization: Bearer feat_live_<key>`

Keys are created in feat.press under App access for an app product. Never expose them in a browser.

## License verification

`POST https://www.feat.press/api/licenses/verify`

```json
{ "licenseKey": "…", "productId": "…" }
```

The response is `{ "valid": true, "entitlement": { … } }` or `{ "valid": false }`. Buyer PII is never returned.

OpenAPI: https://www.feat.press/openapi.json