---
slug: "/docs/v1/integration-guide/validate"
title: "Validate when your app starts"
description: "Stage 8: validate when your app starts with a clear outcome, verification steps and one next action."
section: "Integration Guide"
order: 23
audience: "all"
level: "intermediate"
last_updated: "2026-10-20"
version: "v1"
related: []
draft: false
layout: "guide"
---
## What you will do
Check access before protected work, including on every app launch. Keep one stable client identity.
:::tabs
:::tab python Python
Request a fresh check (the SDK may use signed [offline grace](/docs/v1/start/glossary#offline-grace) after a network failure) with the same state directory:
```bash
.venv/bin/python license-check.py validate
```
For normal launch policy, use:
```bash
.venv/bin/python license-check.py check
```
The same file checks both validity and signature before reporting success.
:::
:::tab javascript JavaScript / Node.js
Request a fresh check (the SDK may use signed offline grace after a network failure) with the same state directory:
```bash
node license-check.mjs validate
```
For normal launch policy, use:
```bash
node license-check.mjs check
```
The same file checks both validity and signature before reporting success.
:::
:::tab php PHP
Request a fresh check (the SDK may use signed offline grace after a network failure) with the same state directory:
```bash
php license-check.php validate
```
For normal launch policy, use:
```bash
php license-check.php check
```
The same file checks both validity and signature before reporting success.
:::
:::tab csharp C# / .NET
Request a fresh check (the SDK may use signed offline grace after a network failure) with the same state directory:
```bash
dotnet run --project Guide.csproj -- validate
```
For normal launch policy, use:
```bash
dotnet run --project Guide.csproj -- check
```
The same file checks both validity and signature before reporting success.
:::
:::tab curl cURL / other language
Use your REST project's validation method with its stored [activation token](/docs/v1/start/glossary#activation-token). Verify the returned signature and bindings before granting access. Raw cURL only tests transport; it does not supply a safe allow/deny decision.
Use the selected language SDK or REST client from [SDKs and languages](/docs/v1/sdks/overview), its [signature verifier](/docs/v1/security/verify-ed25519), and the supported [webhook verifier](/docs/v1/guides/verify-webhook-signatures).
:::
:::

| Result | Your app does |
|---|---|
| Valid, signature verified, required [feature](/docs/v1/start/glossary#feature) enabled | Allow only that feature. |
| Expired, revoked, suspended or cancelled | Deny protected work; explain how to contact the publisher. |
| Invalid signature or inconsistent binding | Deny access; collect a safe [request ID](/docs/v1/start/glossary#request-id) for support. |
| Network failure | Follow the verified, unexpired cache policy in Stage 10; never invent permission. |
The sample prints an access decision. Replace that print with your protected action only after adding the feature check described on the SDK page. A valid [license](/docs/v1/start/glossary#license) does not imply every feature is included.
## Expected result
validate prints [Sandbox](/docs/v1/start/glossary#sandbox) license verified. while the license is valid. Deactivation is a release acknowledgement, never a grant.
## If it does not work
Reusing a different state directory makes a different installation. Check the chosen [product](/docs/v1/start/glossary#product), environment, clock and current license status before asking the [customer](/docs/v1/start/glossary#customer) to reinstall.
## Stage checklist
- Every protected entry point checks access.
- Required feature checks follow verified validity.

## Next steps
[Continue to Stage 9: Check the signed decision](/docs/v1/integration-guide/signatures)