---
slug: "/docs/v1/integration-guide/signatures"
title: "Check the signed decision"
description: "Stage 9: check the signed decision with a clear outcome, verification steps and one next action."
section: "Integration Guide"
order: 24
audience: "all"
level: "intermediate"
last_updated: "2026-10-20"
version: "v1"
related: []
draft: false
layout: "guide"
---
## What you will do
Ensure a fake “licensed” response cannot unlock your app.
A signature is the server's proof that a decision has not been changed. The [public verification key](/docs/v1/start/glossary#public-verification-key) is not a [developer API key](/docs/v1/start/glossary#developer-api-key).
The four [official SDKs](/docs/v1/start/glossary#official-sdk) fetch the public key, verify Ed25519 and check the signed decision against the application, environment, installation and time. The Stage 7 sample also requires the SDK's signature-valid flag. Do not replace this with a success field from raw JSON.
:::tabs
:::tab python Python
Confirm result.valid and result.signature_valid before result.[feature](/docs/v1/start/glossary#feature)("pdf_export"). The sample already requires the first two flags.
:::
:::tab javascript JavaScript / Node.js
Confirm result.valid and result.signatureValid before result.feature('pdf_export'). The sample already requires the first two flags.
:::
:::tab php PHP
Confirm $result->valid and $result->signatureValid before $result->feature('pdf_export'). The sample already requires the first two flags.
:::
:::tab csharp C# / .NET
Confirm result.Valid and result.SignatureValid before result.Feature("pdf_export"). The sample already requires the first two flags.
:::
:::tab curl cURL / other language
REST transport does not supply a universal verified decision. Fetch the public key, canonicalize the original JSON correctly, verify the Ed25519 signature and all signed bindings, then inspect features. Use the real language verifier and negative test vectors, not a new handwritten crypto shortcut.
:::
:::

Use the selected language SDK or REST client from [SDKs and languages](/docs/v1/sdks/overview), its [signature verifier](/docs/v1/security/verify-ed25519), and the supported [webhook verifier](/docs/v1/guides/verify-webhook-signatures).
## Expected result
A modified payload/signature fails closed. The selected SDK/client's negative signature tests must pass for the payload shapes your [product](/docs/v1/start/glossary#product) uses.
## If it does not work
Known Python separator/exponent cases, JavaScript integral-float cases and C# Unicode cache cases are documented in [Current integration limitations](/docs/v1/integration-notes). A narrow successful example does not remove these defects. Do not ship affected cases or bypass verification; seek a compatible release/assessed verifier before [Live](/docs/v1/start/glossary#live).
## Stage checklist
- Tampering is denied.
- Public-key retrieval and rotation policy are understood.
- My production payloads pass the compatibility/test-vector gate.

## Next steps
[Continue to Stage 10: Handle errors and offline use](/docs/v1/integration-guide/real-world)