Licence verification

On plans that include it, every activation and validation answer is signed with Ed25519. Checking that signature in your software means an answer someone edited, an old answer replayed, or one kept alive by setting the computer’s clock back is refused rather than believed. Turning licensing on for a product is covered in Licensing and serial keys.

GET https://<api>/api/v1/licenses/public-key

Copy the PEM it returns into your source when you build. Do not fetch it while your software runs: anyone who can forge an answer can also serve you their own key.

Pass the JSON your activation or validation call returned, and the embedded key:

import { verifyLicense } from "@sellstamp/license-verify";

const check = verifyLicense(await res.json(), PUBLIC_KEY);
if (!check.ok) refuse(check.reason); // "tampered", "expired", "clock_rollback", …

Read features, tier and seats from check.response and nowhere else. A failure comes back as a named reason, not false, because each one has a different fix.

PHP, Python, Go, Ruby and Java have the same check, with the same reasons. What each one needs, which are installable yet, and the line to call are on the SDKs page. For any other language, the integration guide the dashboard generates for a licensed product describes the contract to build against.