Offline licenses

Every active license can be exported as a signed file. Your app verifies it with your organization's public key, with no network access, so it keeps working when the user is offline or SunLicense is down.

Get the file and the public key

• License file: on a license page, click Offline license (license-XXXX….lic). Through the API: GET /api/v1/licenses/{id}/file.
• Public key: API keys → Offline verification key, or GET /api/v1/public-key with an API key. Embed it in your app; it is safe to publish.

File format

base64url(payloadJson) + "." + base64url(ed25519Signature(payloadJson))

The signature covers the exact payload bytes. The payload contains:

Field	Meaning
licenseKey, licenseId, customerEmail	Who the license belongs to
policy.type, policy.maxMachines, policy.expiresAt	The license's rules
issuedAt	When the file was created
refreshAfter	Stop trusting this file after this time (30 days, or expiresAt if sooner)
kid	Which of your signing keys signed it

Verify it (Java, no dependencies)

String[] parts = Files.readString(Path.of("license.lic")).trim().split("\\.");
byte[] payload = Base64.getUrlDecoder().decode(parts[0]);
byte[] signature = Base64.getUrlDecoder().decode(parts[1]);

PublicKey key = KeyFactory.getInstance("Ed25519")
        .generatePublic(new X509EncodedKeySpec(Base64.getDecoder().decode(PUBLIC_KEY)));
Signature verifier = Signature.getInstance("Ed25519");
verifier.initVerify(key);
verifier.update(payload);
boolean authentic = verifier.verify(signature);
// Then parse the payload JSON and check expiresAt and refreshAfter against the clock.

Online first, offline as a fallback

1. Call the validation API. If it answers (200 or 400), trust the answer.
2. If the API can't be reached (network error, timeout, 5xx), verify the offline file instead.

Revocation and offline copies

Revocation reaches online checks within seconds. A file that was already downloaded stays valid until its refreshAfter or expiresAt, whichever comes first. That window is the trade-off between working offline and revoking quickly.