Skip to main content
A .char a licensee downloads with POST /v1/licenses/{key}/download is their own copy. Its manifest.json, the first file in the archive, carries the license under reserved.license, beside the provider’s reserved.provider block. Older readers ignore both.

Verifying it

  1. Take reserved.license and remove signature. What is left is exactly the signed fields.
  2. Find the key with the same kid in GET /v1/.well-known/license-keys.
  3. Check the signature over the canonical JSON of those fields, as in Verify licenses offline.
  4. Check that now is between starts_at and ends_at.
A valid signature proves Omnichar issued the license and that nothing in the block was changed. It cannot show a revocation, so when you have a network, also call GET /v1/licenses/{key}/verify and treat anything other than valid as not licensed. If a license is signed again, as when a licensee named by email signs up, the next download is a new copy with the new signature.