Not misunderstood at all. We cannot of course account for any external service, if that service is not using the software correctly. Keys should be validated using the API call shown. So in your example above, the situation should be
Key is issued
Key is entered into the external service
External service validates if that key is valid against the api
In a situation where its been cancelled, it would show as expired