# Licence verification

> Check in your own software that a licence answer really came from Sellstamp and was not edited, replayed or outlived on a wound-back clock. Libraries exist for TypeScript, PHP, Python, Go, Ruby and Java.

Page: https://sellstamp.com/docs/developers/license-verification

## What a signed answer proves

On plans that include it, every activation and validation answer is signed with Ed25519. Checking that signature in your software means an answer someone edited, an old answer replayed, or one kept alive by setting the computer’s clock back is refused rather than believed. Turning licensing on for a product is covered in [Licensing and serial keys](https://sellstamp.com/docs/products/licensing).

## Embed the public key

```
GET https://<api>/api/v1/licenses/public-key
```

Copy the PEM it returns into your source when you build. Do not fetch it while your software runs: anyone who can forge an answer can also serve you their own key.

## Check every answer

Pass the JSON your activation or validation call returned, and the embedded key:

```
import { verifyLicense } from "@sellstamp/license-verify";

const check = verifyLicense(await res.json(), PUBLIC_KEY);
if (!check.ok) refuse(check.reason); // "tampered", "expired", "clock_rollback", …
```

Read features, tier and seats from `check.response` and nowhere else. A failure comes back as a named reason, not `false`, because each one has a different fix.

## Other languages

PHP, Python, Go, Ruby and Java have the same check, with the same reasons. What each one needs, which are installable yet, and the line to call are on [the SDKs page](https://sellstamp.com/sdks). For any other language, the integration guide the dashboard generates for a licensed product describes the contract to build against.