Check the signed decision

What you will do

Ensure a fake “licensed” response cannot unlock your app.

A signature is the server's proof that a decision has not been changed. The public verification key is not a developer API key.

The four official SDKs fetch the public key, verify Ed25519 and check the signed decision against the application, environment, installation and time. The Stage 7 sample also requires the SDK's signature-valid flag. Do not replace this with a success field from raw JSON.

Python

Confirm result.valid and result.signature_valid before result.feature("pdf_export"). The sample already requires the first two flags.

JavaScript / Node.js

Confirm result.valid and result.signatureValid before result.feature('pdf_export'). The sample already requires the first two flags.

PHP

Confirm $result->valid and $result->signatureValid before $result->feature('pdf_export'). The sample already requires the first two flags.

C# / .NET

Confirm result.Valid and result.SignatureValid before result.Feature("pdf_export"). The sample already requires the first two flags.

cURL / other language

REST transport does not supply a universal verified decision. Fetch the public key, canonicalize the original JSON correctly, verify the Ed25519 signature and all signed bindings, then inspect features. Use the real language verifier and negative test vectors, not a new handwritten crypto shortcut.

Expected result

A modified payload/signature fails closed. The selected SDK/client's negative signature tests must pass for the payload shapes your product uses.

If it does not work

Known Python separator/exponent cases, JavaScript integral-float cases and C# Unicode cache cases are documented in Current integration limitations. A narrow successful example does not remove these defects. Do not ship affected cases or bypass verification; seek a compatible release/assessed verifier before Live.

Stage checklist

Tampering is denied.
Public-key retrieval and rotation policy are understood.
My production payloads pass the compatibility/test-vector gate.

Next steps

Continue to Stage 10: Handle errors and offline use

You are here: Stage 9 of 14.