Signed License Verification and Device Limits
Enable optional signed verification for a saved key product, integrate your application and manage device limits, resets and revocation.
On this page
Key distribution and software enforcement are separate. The API accepts only issued keys attached to eligible paid orders. It returns an Ed25519-signed result bound to the product, key fingerprint, device fingerprint and a fresh request nonce, with a five-minute lifetime. Your application must verify these bindings.
Enable the saved product
Edit a saved license-key product and open Delivery → License verification API. Enable verification and choose 1–100 devices per key. Use random, unguessable keys of at least 16 characters; unused inventory cannot activate.
Implement the documented verification protocol
Read /docs/license-verification.md. Pin the public key and key ID, then verify the exact signed payload, Ed25519 signature, issuer, product, key/device fingerprints, fresh nonce and expiry. Reject malformed or unsigned responses. Never treat a network failure as a valid license.
Explain device privacy and recovery
Use an application-scoped installation identifier instead of collecting hardware serial numbers. The API stores a per-license digest. Explain the device policy to buyers and provide a support route for legitimate reinstalls or hardware replacement.
Reset or revoke deliberately
Use masked key records in Delivery settings to clear device bindings or permanently revoke a key. A device reset does not undo revocation or a full refund. Full refunds close associated key access. A correctly implemented five-minute cache can delay an online revocation decision until its signed result expires.