Connect your deployment.
Each local deployment receives its own revocable token. Keep it in a secret store or a protected configuration file on the deployment. Customer passkeys are only used for the portal.
Check a license
Send an HTTPS request to POST /api/v1/license/check on this website's origin, with the deployment token in the Authorization header. No request body is required.
POST /api/v1/license/check Authorization: Bearer lic_<license-id>.<secret>
For example, replace the URL with this site's address and set LICENSE_TOKEN in your deployment's environment:
curl --request POST \ --header "Authorization: Bearer $LICENSE_TOKEN" \ https://YOUR-SERVICE-URL/api/v1/license/check
Response
{
"valid": true,
"reason": "active",
"licenseId": "...",
"product": "Your service",
"plan": "Standard",
"expiresAt": "2027-10-31T23:59:59.999Z",
"checkedAt": "2026-10-31T12:00:00.000Z",
"nextCheckAt": "2026-10-31T13:00:00.000Z",
"offlineValidUntil": "2026-11-01T12:00:00.000Z"
}| Response | Deployment behavior |
|---|---|
| 200, valid: true | Accept the license; schedule another check in one hour. |
| 200, valid: false | License is expired or revoked. Enforce your product's unlicensed behavior. |
| 401 | Token is missing, invalid, or rotated. Do not treat this as a network outage. |
| 429, 5xx, timeout | Retry with backoff. A previously valid result can be used until offlineValidUntil. |
Check once per hour
Add a small random delay so deployments do not all check at the same minute. Use a 30-second request timeout to allow the API to start after idle periods.
The suggested offline grace period is at most 24 hours from the last successful check and never extends past the license expiry. A deployment must implement this behavior; the server response alone cannot enforce it. It also means an offline deployment may retain access briefly after revocation.
Customer access and recovery
Customers verify their email for their first enrollment, then register a passkey. An existing account cannot use an email link to bypass its passkey. Store the one-time recovery codes shown after enrollment; each allows registration of a replacement passkey. Adding extra passkeys is recommended.
License administration
The administrator issues licenses to registered customers, sets the product, plan, and expiry, and can revoke or extend them. Customers can view their licenses and rotate their deployment tokens. Tokens are shown once; only their hashes are stored.
This initial version manages license entitlements directly. It does not collect payments or synchronize with a billing provider. HTTPS protects API responses in transit; they are not signed offline licenses.