.char a licensee downloads with POST /v1/licenses/{key}/download is their own copy. Its manifest.json, the first file in the archive, carries the license under reserved.license, beside the provider’s reserved.provider block. Older readers ignore both.
Verifying it
- Take
reserved.licenseand removesignature. What is left is exactly the signed fields. - Find the key with the same
kidinGET /v1/.well-known/license-keys. - Check the signature over the canonical JSON of those fields, as in Verify licenses offline.
- Check that now is between
starts_atandends_at.
GET /v1/licenses/{key}/verify and treat anything other than valid as not licensed.
If a license is signed again, as when a licensee named by email signs up, the next download is a new copy with the new signature.