---
title: "SDK and runtime compatibility"
description: "Compare real SDK versions, runtimes, application surfaces, storage behavior, known limitations and verified platform boundaries."
slug: "/docs/v1/sdks/compatibility"
section: "SDKs and languages"
order: 63
audience: "all"
level: "advanced"
last_updated: "2026-10-21"
version: "v1"
related: ["/docs/v1/sdks/overview", "/docs/v1/security/test-vectors"]
draft: false
---
Choose by actual runtime and trust behavior, not an unverified universal-parity claim.

## What you will learn
- Compare all four [official SDKs](/docs/v1/start/glossary#official-sdk) with ten REST projects.
- Understand native OS, cache, [feature](/docs/v1/start/glossary#feature) and vault boundaries.
- Plan a controlled source/dependency upgrade.

## Prerequisites
- Complete [the Sandbox quickstart](/docs/v1/start/quickstart).
- Read [signed responses](/docs/v1/security/signed-responses), [authentication](/docs/v1/start/authentication) and [offline mode](/docs/v1/security/offline-mode).

## Current source versions
| Language | Observed version | Declared target | Actual requirement / boundary | Application surface |
| --- | --- | --- | --- | --- |
| python | 1.1.5 | >=3.11,<3.15 | Python 3.11–3.14 | PyPI package; import kdpika_licensing |
| php | 1.0.0 | ^8.1 | PHP8.2+ (readonly result class) | Composer PSR-4 backend library |
| javascript | 1.0.0 | >=18 | Node18+; test each deployed runtime | module; Node/Electron main process only |
| csharp | 1.0.0 | net7.0 | .NET7+ compatible target; prefer maintained runtime | C# project reference; async client |
Version1.0.0 identifies the observed source package; PHP uses the existing versioned download label, not a Composer version field. Python 1.1.5 is now published on [PyPI](https://pypi.org/project/kdpika-licensing/) with [GitHub source](https://github.com/kdpika/kdpika-licensing); other packages remain source downloads. No support-duration SLA is implied. Source ZIP SHA-256 values on the overview are the package integrity source.

## Actual runtime verification
All four official source packages have clean local installs and current package test entries. Python, PHP, Node and C# execute genuine isolated Sandbox lifecycle programs. The current package test suite includes a new PHP package-local entry with the same assertions; the unchanged legacy repository entry still assumes repository-root vendor/autoload.php.
The ten REST projects compile/execute using pinned development dependencies, build from fresh exact ZIP extractions and run actual Sandbox checks. TypeScript uses Node22 for this complete example; that is not a change to the official Node SDK minimum. Go has no external runtime module. C/C++ use an explicit POSIX core; Swift here is macOS/CryptoKit, not a claimed universal target.

## Operating systems and UI
The available native host is macOS. Portable runtimes can target other supported systems, but Windows/Linux/mobile execution is not inferred from a macOS build. WPF requires Windows: its full project cross-builds with Windows targeting and its shared controller executes on the local Sandbox, but its native UI is not executed on macOS.
Electron source and unsigned macOS packaged-app runs are separate verified cases. Python CLI also runs as a frozen PyInstaller macOS build. Code signing, notarization, Windows/Linux packaging, assistive-technology certification and real OS-vault backends remain separate deployment responsibilities.

## Storage and feature semantics
Python can prefer an available positive-priority keyring, with permission-protected file fallback. PHP, Node and C# do not automatically provide Keychain/DPAPI/Secret Service adapters. See the tested storage guidance before claiming encrypted-vault protection.
Every feature helper must follow a valid/signature gate. Helpers differ in truthiness/fallback semantics, especially C# nonboolean values; numeric quotas require explicit type/range checks. A successful deactivation has valid=true for the release operation but no entitlement grant. activated/token presence is not current [license](/docs/v1/start/glossary#license) validity.

## Known compatibility gaps
| Current source | Observed issue | Safe application response |
| --- | --- | --- |
| Legacy Python 1.0.0 | Separator/exponent canonicalization defects | Upgrade to Python SDK 1.1.5; retain all signature and binding checks |
| JavaScript official SDK | Integral-float spelling such as19.0 can be lost | Deny invalid signature; the REST TypeScript example uses the separate lossless P5 verifier |
| C# | Cached Unicode serialization can invalidate a real signed state | Online recovery may work; genuine offline cache failure is not falsely reported as success |
| PHP | ^8.1 metadata conflicts with readonly class requiring8.2; PHP8.5 curl_close notice | Use the actual source runtime and handle deprecation separately; never suppress licensing validation |
| Legacy/source SDKs | Feature helpers alone may not enforce result validity | Gate valid and signature status before feature use |
| Signing keys | No historical key ring/overlap promise supplied | Pin trust deliberately and coordinate updates |
These are documented source defects/limits, not approvals to modify SDK behavior. Runtime implementations, APIs and protected [product](/docs/v1/start/glossary#product) files stay unchanged by this documentation release.

## Compatibility policy
API v1 is independent of SDK package versions. Pin exact source/dependency locks and test current response/cache/clock/refusal behavior before updating. A file named1.0.0 does not establish support for every historical release. Additional fields should not be stripped from signed payloads; signature canonicalization must include the complete signed payload.
Treat constructor/API changes, namespace/identity changes, signed-byte behavior, token format and offline-time rules as compatibility-sensitive. No minimum deprecation notice, support window or automatic old-key overlap is promised where the actual product does not implement one.

## Choose and verify your target
1. Match the actual runtime and application surface in the table. Expected: a library/client suitable for your trusted process.
2. Download and verify the exact source archive. Expected: SHA-256 matches the overview.
3. Follow the complete guide in a clean application project. Expected: pinned dependency restore/build and matching API surface.
4. Run real signed [activation](/docs/v1/start/glossary#activation), cache reload, offline/refusal and release. Expected: explicit accepted decisions or safe refusals, not assumptions from successful import.
5. Repeat after packaging on your actual target OS. Expected: native proof for your distribution, without claiming other targets were executed.

## Expected result
Your integration authenticates signed state and handles failures without granting features. Installation identity, source version and test boundaries remain explicit.

## Common mistakes
- Assuming a declared runtime minimum proves native execution on every OS.
- Treating all feature helper fallbacks as identical.

## Security notes
Keep [developer](/docs/v1/start/glossary#developer) keys on trusted backends, pin independent key trust, preserve HTTPS/signature verification and never equate token presence with permission. Local machine owners can patch software; a successful build or checksum is not an anti-tamper certification.

## Troubleshooting
| Symptom | Cause | Action |
| --- | --- | --- |
| PHP8.1 parse failure | Actual readonly class requires8.2 | Use the actual supported source runtime |
| C# offline fails after restart | Known Unicode cache byte mismatch | Fail closed and reconnect; do not strip signed fields |
| Unknown package registry release | No public registry publication established | Install the exact source ZIP and verify its checksum |

## Next steps
Review [the SDK downloads](/docs/v1/sdks/overview), [test vectors](/docs/v1/security/test-vectors) and [API errors](/docs/v1/api/errors) for the exact selected client.

## Related
- [Installation identity](/docs/v1/security/installation-id)
- [Secure token storage](/docs/v1/security/secure-token-storage)
- [API conventions](/docs/v1/api/conventions)