Validation API

Called by your customers' apps, authenticated with an API key. Validation is never limited by your plan.

POST /api/v2/license/validate

The endpoint the official SDKs call. 200 = valid, 400 = rejected.

POST /api/v2/license/validate
Authorization: Bearer slk_...
Content-Type: application/json

{ "license": "K7QX-M2PD-9HWT-R4CN", "host": "machine-a" }

{ "valid": true, "status": 200, "message": "License is valid", "code": "VALID", "expiresAt": "2027-10-12T09:23:51Z" }

The machine id is read from the first of fingerprint, hwid, host or macAddress.

POST /api/v1/validate

The same rules with a different shape: a rejected license is 200 with valid: false, so "the server said no" is never confused with "the server is down".

// request
{ "licenseKey": "K7QX-M2PD-9HWT-R4CN", "fingerprint": "machine-a", "hostname": "Jane's laptop" }
// response
{ "valid": false, "code": "TOO_MANY_MACHINES", "detail": "License is already active on the maximum number of machines",
  "expiresAt": "2027-10-12T09:23:51Z", "machines": { "used": 2, "max": 2 } }

POST /api/v1/activate

Same request and response as /api/v1/validate, for apps that activate explicitly on first run.

POST /api/v1/deactivate

// request
{ "licenseKey": "K7QX-M2PD-9HWT-R4CN", "fingerprint": "machine-a" }
// response
{ "deactivated": true }

GET /api/v1/public-key

Your organization's Ed25519 public key for offline verification.

{ "keyId": "2026-10-12-1a2b3c4d", "algorithm": "Ed25519", "publicKey": "MCowBQYDK2VwAyEA…" }