KDPika Licensing
Sign inStart freeUse a test license to inspect activation, validation and deactivation; this console never grants application access.
What you will learn
- Send real Sandbox requests and see the API reply.
- Understand in-memory credentials, device seats and the Live guard.
Prerequisites
- Read API conventions.
- Complete the Sandbox quickstart.
Before sending a request
Create a Sandbox product/plan/license using the quickstart. Copy its public App ID and TEST-prefixed license key. Reading documentation requires no account; obtaining your own test license requires your Sandbox workspace. Do not use a real buyer email or any Live credential.
The console uses the current site origin and a fixed SANDBOX activation header. There is no user-supplied target URL or Live environment selector. The TEST-prefix input check is helpful UX; the actual API environment-scoped lookup is the trust boundary. Developer API keys are not accepted here.
Interactive inspector
Sandbox request inspector
Sandbox only. Uses your test license and makes real requests to this site's API. No payment is made. Never paste a Live license, developer API key or customer data from a real buyer.
The request inspector is loading. No request has been sent.
Activate first: this console never accepts a pasted activation token. Validation/deactivation use only the token returned by this console's successful Sandbox activation. Deactivate before clearing if you want to release its seat. This inspector does not grant access to application features or replace Ed25519 verification.
Last request (credentials hidden)
No request yet.
Last response
No response yet.
How to use it
- Retrieve the public key if you want to inspect the current verification-key response. Expected: JSON with algorithm/key_id/public_key/encoding.
- Enter your test App ID, Sandbox key and optional matching email. Expected: a temporary random installation ID appears only on this page.
- Confirm that the data is for testing, then activate. Expected: the real API accepts or rejects the request; a successful Sandbox token is held only in this page memory.
- Validate that same installation. Expected: a fresh signed snapshot or an explicit refusal; no application feature is enabled by this inspector.
- Deactivate before clearing/reloading if you want to release the seat. Expected: success releases the concurrent seat, but does not reset lifetime activation_count.
- Clear sensitive data when finished. Expected: form values/token/response are removed from this page; clearing by itself does not deactivate a seat.
Refreshing, navigating away or clearing loses the console token/temporary identity. A new activation can consume another lifetime activation. Recover an abandoned test seat through your supported Sandbox device controls; do not mistake cache clearing for deactivation.
Privacy and security boundaries
Requests go directly to this site API over HTTPS, never through a documentation proxy or external service. Authorization is sent only for the in-memory token obtained by this console successful Sandbox activation. You cannot paste a Live activation token. Validation/deactivation remain disabled until that Sandbox activation succeeds.
Credentials are not written to localStorage, sessionStorage, cookies, indexedDB, feedback, analytics or console logs by this inspector. The form and response exist temporarily in browser memory. HTTP requests necessarily transmit your test inputs to the API. The normal API metadata logger records method/path/status/request ID and hashed IP, not Authorization or request bodies.
The response token is hidden by default; a deliberate reveal checkbox shows it only on this screen. A signed license payload may include your supplied test email and other test customer fields. Avoid screenshots or screen sharing with sensitive details. Your own browser extensions, developer tools and device administrator are outside the page security boundary.
The console deliberately inspects transport and server behavior; it does not implement local Ed25519 access authorization or fix the SDK/idempotency limitations. Use the verification vectors when building an application client.
Expected result
You can see real Sandbox HTTP status/body/request ID while token operations remain bound to a Sandbox activation created in this page.
Common mistakes
- Using a Live license or trying to paste a developer API key.
- Clearing/reloading before deactivation and assuming the seat was released.
- Treating a displayed JSON success as your application entitlement gate.
Security notes
Use only test data. No hosted request is automatically sent when opening this page. Unknown/invalid responses do not enable token actions. JavaScript is required only for sending requests, not for reading examples.
Troubleshooting
| Symptom | Cause | Action |
|---|---|---|
| Validate/deactivate disabled | No successful Sandbox activation in this page memory | Activate a test installation here first |
| Key rejected before request | Not a TEST-prefixed Sandbox key | Use a license from your Sandbox workspace |
| Email mismatch | Nonempty email does not match customer | Use the license customer email or intentionally test key-only mode |
| Request interrupted | Network/timeout/redirect/unexpected response | No access is granted; reconcile any consumed test seat before retrying |
Next steps
Review the endpoint reference and signature verification.