---
slug: "/docs/v1/integration-guide/storage"
title: "Protect tokens and identity"
description: "Stage 11: protect tokens and identity with a clear outcome, verification steps and one next action."
section: "Integration Guide"
order: 26
audience: "all"
level: "intermediate"
last_updated: "2026-10-20"
version: "v1"
related: []
draft: false
layout: "guide"
---
## What you will do
Keep one stable installation identity and protect its token/cache.
The example intentionally uses a private state directory. It demonstrates the SDK's file behavior, not complete production vault integration.
| Platform | Simplest correct starting point |
|---|---|
| Windows | A per-user LocalAppData directory with user-only ACLs; assess DPAPI or Credential Manager through an appropriate adapter. |
| macOS | A user-owned application-support directory; assess Keychain for the private token. |
| Linux | A user-owned application-data directory with restrictive permissions; assess Secret Service availability. |
| Shared backend | A private path outside the web root, isolated per application tenant/installation. |
Do not invent an adapter constructor option. The Python SDK can use its existing keyring support; the other current SDKs' file implementations require assessment before claiming a vault. No vault is installed by the sample.
1. Preserve the SDK-created installation identity through restarts.
2. Keep App ID/environment/state namespaces separate.
3. Never sync [activation tokens](/docs/v1/start/glossary#activation-token) through a public repository or distribute your activated test directory.
4. Serialize identity, [activation](/docs/v1/start/glossary#activation) and deactivation writes for the same installation.
Use the selected language SDK or REST client from [SDKs and languages](/docs/v1/sdks/overview), its [signature verifier](/docs/v1/security/verify-ed25519), and the supported [webhook verifier](/docs/v1/guides/verify-webhook-signatures).
## Expected result
A restarted app validates the same installation without consuming another seat. Another OS user cannot read its private files.
## If it does not work
Deleting identity state is not a [license](/docs/v1/start/glossary#license) reset. A customer-controlled desktop cannot be made tamper-proof; enforce valuable online operations on your authenticated backend too.
## Stage checklist
- I checked file permissions on every supported OS.
- My app does not ship a private activation token or [developer API key](/docs/v1/start/glossary#developer-api-key).
- Unsupported storage/runtime assumptions are resolved before [Live](/docs/v1/start/glossary#live).

## Next steps
[Continue to Stage 12: Deliver licenses to customers](/docs/v1/integration-guide/deliver)