---
title: "Go REST client"
description: "Build a complete Go Sandbox licensing client with verified signatures, persistent identity, private state, offline policy and safe feature gating."
slug: "/docs/v1/sdks/go"
section: "SDKs and languages"
order: 56
audience: "all"
level: "intermediate"
last_updated: "2026-10-17"
version: "v1"
related: ["/docs/v1/api/activate", "/docs/v1/security/offline-mode"]
draft: false
---
Use the real API v1 from a trusted Go process with explicit signature and policy checks before enabling [features](/docs/v1/start/glossary#feature). This REST sample is not an additional [official SDK](/docs/v1/start/glossary#official-sdk).

## What you will learn
- Activate, validate and deactivate one stable [Sandbox](/docs/v1/start/glossary#sandbox) installation.
- Preserve signed bytes and verify the trusted Ed25519 key before policy.
- Handle cache, [offline grace](/docs/v1/start/glossary#offline-grace), explicit rejection and safe user messages.

## Prerequisites
- Complete [the Sandbox quickstart](/docs/v1/start/quickstart).
- Read [authentication](/docs/v1/start/authentication) and [signed responses](/docs/v1/security/signed-responses).
- Have the [product](/docs/v1/start/glossary#product) App ID, a Sandbox [license](/docs/v1/start/glossary#license) and its matching [customer](/docs/v1/start/glossary#customer) email when supplied.
- Obtain the actual [public-key document](/docs/v1/api/public-key) over independently trusted HTTPS and distribute/pin it through controlled application configuration, not from an untrusted envelope.

## Runtime and application type
Go1.22+, standard library only. Native CLI or backend, without third-party Go runtime modules. Build for each target and validate its TLS roots/ACLs. Its reusable signature.go is derived from the complete P5 verifier with only the original CLI main and unused os import removed. An exclusive-create lock refuses concurrent writers; reconcile a stale lock after confirming its process ended.

## Complete project and integrity
<!-- P7-PROJECT-PACKAGE:START -->
The complete project archive contains every client/verifier source and the exact build/dependency metadata needed by this language. Extract it with its original directory layout. Dependencies/locks are included where this runtime uses them; no hidden helper or test-only clock is required.

[kdpika-go-rest-example-1.0.0.zip](/docs/downloads/kdpika-go-rest-example-1.0.0.zip) · 8141 bytes · version 1.0.0

SHA-256: 2d034b773ed49c069553ab3f4f97d63ea528f11c784b01ba14ac3ff87bdd25e8
<!-- P7-PROJECT-PACKAGE:END -->
Extract the entire project, preserving its samples/sdks and samples/security layout. The archive includes all first-party client/verifier sources and pinned manifests/locks; dependency downloads are development-time restoration, never extra services needed by the PHP host. Do not flatten the tree or replace the verification helper with a generic JSON reserializer.

## Install and build
1. Verify the archive SHA-256 against the current table. Expected: exact digest match; otherwise stop.
2. Extract into a clean private development directory. Expected: complete samples tree with the language project.
3. Enter samples/sdks/go. Expected: the main client and build/dependency files are present.
4. Install the stated runtime/native libraries, then run the full build command below. Expected: successful syntax check or native executable, not a registry SDK download.
```bash
sh build.sh
```
The source scripts compile the exact files and validate third-party download checksums where applicable. Compiler toolchains are development dependencies, not tools to install on KDPika shared hosting. macOS is the actual tested runtime; other targets require their own build/permission/TLS-root checks.

## Application configuration
| Variable | Required | Meaning |
| --- | --- | --- |
| KDP_APP_ID | Yes | [Public App ID](/docs/v1/start/glossary#public-app-id), not internal product ID or [developer](/docs/v1/start/glossary#developer) key |
| KDP_BASE_URL | No | HTTPS API base ending /api/v1; default https://licensing.kdpika.com/api/v1 |
| KDP_STATE_DIR | Yes | Absolute private application state root; keep it stable |
| KDP_TRUSTED_KEY_FILE | Yes | Absolute path to an independently trusted public-key document |
| KDP_LICENSE_KEY | [Activation](/docs/v1/start/glossary#activation) | Sandbox key beginning TEST; never embedded in distributed source |
| KDP_CUSTOMER_EMAIL | Optional | Actual matching customer email for email-bound activation |
| KDP_ALLOW_LOOPBACK | Local testing only | 1 permits explicit localhost/127.0.0.1 HTTP, not arbitrary HTTP hosts |

Environment is fixed to SANDBOX in this example. Unsafe URL credentials/query/fragment and nonlocal HTTP are rejected. Official SDK constructors expect the site origin; these REST programs expect /api/v1. Store state and trusted keys outside public web roots. Do not ship lmp_ developer management keys.

## Complete runnable client
```go
// Complete Sandbox REST CLI; Go1.22+, standard library only.
// Build with adjacent signature.go derived byte-for-byte from the P5 verifier
// without its CLI main. Run session status|activate|check|validate|deactivate.
package main

import (
 "crypto/rand"
 "crypto/sha256"
 "encoding/hex"
 "encoding/json"
 "errors"
 "fmt"
 "io"
 "net/http"
 "net/url"
 "os"
 "path/filepath"
 "regexp"
 "strings"
 "time"
)

type refusal struct{code string;requestID string}
func (r refusal) Error()string{return r.code}
type unreachable struct{}
func (unreachable) Error()string{return "network unavailable"}
type stored struct{Token string `json:"token"`;Envelope *string `json:"envelope"`;Checkpoint string `json:"checkpoint"`}
type session struct{app,base,dir,installation string;key []byte;lock *os.File;http *http.Client}
func hash(v string)string{sum:=sha256.Sum256([]byte(v));return hex.EncodeToString(sum[:])}
func required(name string)string{v:=os.Getenv(name);if v==""||strings.ContainsAny(v,"\r\n"){panic("configuration")};return v}
func readPrivate(path string)([]byte,error){stat,err:=os.Lstat(path);if err!=nil{return nil,err};if !stat.Mode().IsRegular()||stat.Size()>1048576{return nil,errors.New("unsafe file")};return os.ReadFile(path)}
func jsonObject(raw []byte)(map[string]any,error){v,e:=parse(raw);if e!=nil{return nil,e};m,ok:=v.(map[string]any);if !ok{return nil,errors.New("object required")};return m,nil}
func text(m map[string]any,k string)string{v,ok:=m[k].(string);if !ok{panic("missing string")};return v}
func parseTime(v string)(time.Time,error){t,e:=time.Parse(time.RFC3339Nano,v);if e!=nil{return t,refusal{"INVALID_TIME",""}};return t,nil}
func (s *session) write(name string,v any)error{
 raw,e:=json.Marshal(v);if e!=nil{return e};file,e:=os.CreateTemp(s.dir,"write-");if e!=nil{return e};temporary:=file.Name()
 if e=file.Chmod(0600);e==nil{_,e=file.Write(raw)};if e==nil{e=file.Sync()};closeError:=file.Close();if e==nil{e=closeError};if e!=nil{return e};return os.Rename(temporary,filepath.Join(s.dir,name))
}
func openSession()(*session,error){
 s:=&session{app:required("KDP_APP_ID")};if !regexp.MustCompile(`^[A-Za-z0-9_-]{3,160}$`).MatchString(s.app){return nil,errors.New("app ID")}
 base:=os.Getenv("KDP_BASE_URL");if base==""{base="https://licensing.kdpika.com/api/v1"};u,e:=url.Parse(strings.TrimRight(base,"/"));if e!=nil{return nil,e}
 local:=u.Scheme=="http"&&(u.Hostname()=="127.0.0.1"||u.Hostname()=="localhost")&&os.Getenv("KDP_ALLOW_LOOPBACK")=="1"
 if u.Hostname()==""||(u.Scheme!="https"&&!local)||u.User!=nil||u.RawQuery!=""||u.Fragment!=""||u.Path!="/api/v1"{return nil,errors.New("URL")};s.base=u.String()
 root,keyfile:=required("KDP_STATE_DIR"),required("KDP_TRUSTED_KEY_FILE");if !filepath.IsAbs(root)||!filepath.IsAbs(keyfile){return nil,errors.New("absolute paths")}
 s.key,e=readPrivate(keyfile);if e!=nil{return nil,e};key,e:=jsonObject(s.key);if e!=nil||key["algorithm"]!="Ed25519"||key["encoding"]!="base64url"{return nil,errors.New("key")}
 if e=os.MkdirAll(root,0700);e!=nil{return nil,e};info,e:=os.Lstat(root);if e!=nil||!info.IsDir()||info.Mode()&os.ModeSymlink!=0{return nil,errors.New("root")}
 s.dir=filepath.Join(root,hash(s.base+"|"+s.app+"|SANDBOX|go-rest-v1")[:20]);if e=os.MkdirAll(s.dir,0700);e!=nil{return nil,e}
 info,e=os.Lstat(s.dir);if e!=nil||!info.IsDir()||info.Mode()&os.ModeSymlink!=0{return nil,errors.New("namespace")};if e=os.Chmod(s.dir,0700);e!=nil{return nil,e}
 s.lock,e=os.OpenFile(filepath.Join(s.dir,".lock"),os.O_CREATE|os.O_EXCL|os.O_WRONLY,0600);if e!=nil{return nil,e}
 success:=false;defer func(){if !success{s.close()}}()
 identity:=filepath.Join(s.dir,"installation.json");raw,e:=readPrivate(identity)
 if os.IsNotExist(e){random:=make([]byte,16);if _,e=rand.Read(random);e!=nil{return nil,e};random[6]=(random[6]&15)|64;random[8]=(random[8]&63)|128
  id:=fmt.Sprintf("lmp-install-%x-%x-%x-%x-%x",random[:4],random[4:6],random[6:8],random[8:10],random[10:]);if e=s.write("installation.json",map[string]string{"installation_id":id});e!=nil{return nil,e};raw,e=readPrivate(identity)}
 if e!=nil{return nil,e};value,e:=jsonObject(raw);if e!=nil{return nil,e};s.installation=text(value,"installation_id")
 if !regexp.MustCompile(`^lmp-install-[a-f0-9-]{36}$`).MatchString(s.installation){return nil,errors.New("invalid identity; do not reset automatically")}
 s.http=&http.Client{Timeout:15*time.Second,CheckRedirect:func(_ *http.Request,_ []*http.Request)error{return http.ErrUseLastResponse}};success=true;return s,nil
}
func(s *session)close(){if s.lock!=nil{s.lock.Close();os.Remove(filepath.Join(s.dir,".lock"));s.lock=nil}}
func(s *session)state()(*stored,error){raw,e:=readPrivate(filepath.Join(s.dir,"session.json"));if os.IsNotExist(e){return nil,nil};if e!=nil{return nil,e};if _,e=jsonObject(raw);e!=nil{return nil,e};var value stored
 if e=json.Unmarshal(raw,&value);e!=nil{return nil,e};if !regexp.MustCompile(`^act_[A-Za-z0-9_-]+$`).MatchString(value.Token){return nil,errors.New("stored token")};if _,e=parseTime(value.Checkpoint);e!=nil{return nil,e};return &value,nil}
func(s *session)clear()error{e:=os.Remove(filepath.Join(s.dir,"session.json"));if os.IsNotExist(e){return nil};return e}
func(s *session)request(endpoint string,body map[string]any,token string)(map[string]any,string,error){
 raw,e:=json.Marshal(body);if e!=nil{return nil,"",e};req,e:=http.NewRequest("POST",s.base+endpoint,strings.NewReader(string(raw)));if e!=nil{return nil,"",e}
 req.Header.Set("Content-Type","application/json");req.Header.Set("Accept","application/json");req.Header.Set("User-Agent","KDPika-REST-Go-example/1.0")
 if token==""{req.Header.Set("X-App-ID",s.app);req.Header.Set("X-Environment","SANDBOX")}else{req.Header.Set("Authorization","Bearer "+token);req.Header.Set("X-Installation-ID",s.installation)}
 response,e:=s.http.Do(req);if e!=nil{return nil,"",unreachable{}};defer response.Body.Close();raw,e=io.ReadAll(io.LimitReader(response.Body,1048577));if e!=nil{return nil,"",unreachable{}};if len(raw)>1048576{return nil,"",refusal{"INVALID_RESPONSE",""}}
 value,e:=jsonObject(raw);if e!=nil{return nil,"",refusal{"INVALID_RESPONSE",""}};id,_:=value["request_id"].(string);if !regexp.MustCompile(`^req_[A-Za-z0-9_-]{1,120}$`).MatchString(id){id=""}
 if response.StatusCode<200||response.StatusCode>=300||value["success"]!=true{code:="HTTP_ERROR";if errorObject,ok:=value["error"].(map[string]any);ok{if c,ok:=errorObject["code"].(string);ok&&regexp.MustCompile(`^[A-Z0-9_]{1,64}$`).MatchString(c){code=c}};return nil,id,refusal{code,id}}
 return value,id,nil
}
func success(source,id string)map[string]any{var request any;if id!=""{request=id};return map[string]any{"valid":true,"source":source,"signature_valid":false,"error_code":nil,"request_id":request,"pdf_export_allowed":false,"seat_count":nil,"message":"Your license is ready."}}
func(s *session)verify(envelope,source,checkpoint,id string)(map[string]any,error){
 if !VerifyEnvelope(s.key,[]byte(envelope)){return nil,refusal{"SIGNATURE_INVALID",id}};env,e:=jsonObject([]byte(envelope));if e!=nil{return nil,e};p,ok:=env["payload"].(map[string]any);if !ok{return nil,refusal{"INVALID_RESPONSE",id}};device,ok:=p["device"].(map[string]any)
 if !ok||p["product_id"]!=s.app||p["environment"]!="sandbox"||device["installation_hash"]!=hash(s.installation){return nil,refusal{"BINDING_MISMATCH",id}}
 server,e:=parseTime(text(p,"server_time"));if e!=nil{return nil,e};next,e:=parseTime(text(p,"next_validation_at"));if e!=nil{return nil,e};grace,e:=parseTime(text(p,"offline_grace_until"));if e!=nil{return nil,e};if next.Before(server)||grace.Before(server){return nil,refusal{"INVALID_TIME",id}}
 latest:=server;if checkpoint!=""{previous,e:=parseTime(checkpoint);if e!=nil{return nil,e};if previous.After(latest){latest=previous}};now:=time.Now()
 if now.Add(300*time.Second).Before(latest){return nil,refusal{"CLOCK_ROLLBACK_DETECTED",id}};if p["status"]!="active"{return nil,refusal{"LICENSE_NOT_ACTIVE",id}}
 if p["starts_at"]!=nil{start,e:=parseTime(text(p,"starts_at"));if e!=nil{return nil,e};if now.Before(start){return nil,refusal{"LICENSE_NOT_STARTED",id}}}
 if p["expires_at"]!=nil{expiry,e:=parseTime(text(p,"expires_at"));if e!=nil{return nil,e};if !now.Before(expiry){return nil,refusal{"LICENSE_EXPIRED",id}}}
 if source!="online"&&now.After(grace){return nil,refusal{"OFFLINE_GRACE_EXPIRED",id}};features,ok:=p["features"].(map[string]any);if !ok{return nil,refusal{"INVALID_RESPONSE",id}}
 result:=success(source,id);result["signature_valid"]=true;result["pdf_export_allowed"]=features["pdf_export"]==true
 if count,ok:=features["seat_count"].(json.Number);ok{if integer,e:=count.Int64();e==nil&&integer>=0&&integer<=9007199254740991{result["seat_count"]=integer}};return result,nil
}
func(s *session)run(action string)(map[string]any,error){
 state,e:=s.state();if e!=nil{return nil,e};if action=="status"{return map[string]any{"activated":state!=nil,"installation_hash":hash(s.installation),"storage_security":"permission-protected-file"},nil}
 if action=="activate"{license:=required("KDP_LICENSE_KEY");if !strings.HasPrefix(license,"TEST"){return nil,errors.New("Sandbox key required")};if state!=nil{return nil,refusal{"ALREADY_ACTIVATED",""}}
  body:=map[string]any{"license_key":license,"device_id":s.installation,"device_name":"Go REST example","platform":"go","app_version":"1.0.0"};if os.Getenv("KDP_CUSTOMER_EMAIL")!=""{body["email"]=required("KDP_CUSTOMER_EMAIL")}
  response,id,e:=s.request("/licenses/activate",body,"");if e!=nil{return nil,e};token,ok:=response["activation_token"].(string);if !ok||!regexp.MustCompile(`^act_[A-Za-z0-9_-]+$`).MatchString(token){return nil,refusal{"INVALID_RESPONSE",id}}
  envelope:=canonical(response["license"]);result,e:=s.verify(envelope,"online","",id);if e!=nil{s.request("/licenses/deactivate",map[string]any{},token);return nil,e}
  return result,s.write("session.json",stored{token,&envelope,time.Now().UTC().Format(time.RFC3339Nano)})}
 if state==nil{return nil,refusal{"NOT_ACTIVATED",""}};if action=="deactivate"{response,id,e:=s.request("/licenses/deactivate",map[string]any{},state.Token);if e!=nil{return nil,e};if response["deactivated"]!=true{return nil,refusal{"INVALID_RESPONSE",id}};if e=s.clear();e!=nil{return nil,e};result:=success("online",id);result["message"]="This installation has been deactivated.";return result,nil}
 if action=="check"&&state.Envelope!=nil{result,e:=s.verify(*state.Envelope,"cache",state.Checkpoint,"");if e==nil{env,_:=jsonObject([]byte(*state.Envelope));p:=env["payload"].(map[string]any);next,_:=parseTime(text(p,"next_validation_at"));if time.Now().Before(next){state.Checkpoint=time.Now().UTC().Format(time.RFC3339Nano);return result,s.write("session.json",state)}}else{state.Envelope=nil;if e=s.write("session.json",state);e!=nil{return nil,e}}}
 response,id,e:=s.request("/licenses/validate",map[string]any{},state.Token)
 if e!=nil{var offline unreachable;if errors.As(e,&offline){if state.Envelope==nil{return nil,refusal{"OFFLINE_CACHE_MISSING",""}};result,e:=s.verify(*state.Envelope,"offline",state.Checkpoint,"");if e!=nil{return nil,e};state.Checkpoint=time.Now().UTC().Format(time.RFC3339Nano);return result,s.write("session.json",state)}
  var denied refusal;if errors.As(e,&denied){state.Envelope=nil;if denied.code=="INVALID_TOKEN"||denied.code=="DEVICE_MISMATCH"||denied.code=="LICENSE_REVOKED"||denied.code=="LICENSE_EXPIRED"||denied.code=="LICENSE_CANCELLED"{s.clear()}else{s.write("session.json",state)}};return nil,e}
 envelope:=canonical(response["license"]);result,e:=s.verify(envelope,"online",state.Checkpoint,id);if e!=nil{state.Envelope=nil;s.write("session.json",state);return nil,e};state.Envelope=&envelope;state.Checkpoint=time.Now().UTC().Format(time.RFC3339Nano);return result,s.write("session.json",state)
}
func execute()(code int){code=2;defer func(){if recover()!=nil{fmt.Fprintln(os.Stderr,"Check application settings and private storage. Contact your software provider if the problem continues.")}}()
 if len(os.Args)!=2||!regexp.MustCompile(`^(status|activate|check|validate|deactivate)$`).MatchString(os.Args[1]){panic("action")};s,e:=openSession();if e!=nil{panic(e)};defer s.close();result,e:=s.run(os.Args[1]);if e!=nil{var denied refusal;var offline unreachable
  if !errors.As(e,&denied)&&!errors.As(e,&offline){panic(e)};if denied.code==""{denied.code="NETWORK_ERROR"};result=success("local",denied.requestID);result["valid"]=false;result["error_code"]=denied.code;result["message"]="Your license could not be confirmed. Connect and try again, or contact your software provider.";code=1}else{code=0}
 raw,e:=json.Marshal(result);if e!=nil{panic(e)};fmt.Println(string(raw));return code}
func main(){os.Exit(execute())}
```
```text
module example.invalid/kdpika-rest-session

go 1.22
```
The complete project also contains the exact verification helper. Its source and all positive/negative vectors are available in the [security verifier archive](/docs/downloads/security-verifiers.zip). Derived reusable files remove only the original standalone CLI entry point/imports that became unused; they do not change the signature algorithm or canonicalization.

## Run the lifecycle
Use ./session followed by exactly one action. Preserve the same App ID, state root and origin across processes.
1. Run status. Expected: activated=false for a new namespace and only an installation hash/storage category. Token presence is not a license validity decision.
2. Set a Sandbox key and matching email, then run activate. Expected: valid=true and signature_valid=true, or a safe refusal. An existing token is not silently replaced.
3. Run check. Expected: eligible authenticated cache before next_validation_at, otherwise an online validation attempt.
4. Run validate. Expected: an online attempt; only transport failure can use an eligible verified offline cache. Explicit HTTP rejection never grants offline permission.
5. Run deactivate. Expected: server-confirmed release, token/cache removal and no feature grant. valid=true here means the release operation succeeded, not permission to run a protected feature.
6. Run status again. Expected: activated=false and the same installation hash. Cumulative activation_count is not reset.
Exit0 means accepted operation/status, exit1 means refusal or connectivity denial, exit2 means unsafe configuration/state or unexpected failure. Output is safe decision metadata: never raw keys, tokens, Authorization headers or signed customer payloads.

## API contract and signature verification
Activation sends X-App-ID and X-Environment: SANDBOX plus license_key/device_id and optional matching email. Validation uses Bearer act_ and X-Installation-ID. Deactivation releases that token. See the [endpoint reference](/docs/v1/api/conventions) for full field/response/error tables.
The response parser preserves numeric lexemes, rejects duplicate/invalid JSON through the shared tested verifier, and authenticates the exact envelope. Only a verified payload enters policy. Key ID is derived from the independently trusted raw public key; wrong algorithm/key/signature is rejected. Never repair a mismatch by stripping signed fields or using JSON.stringify-style numeric normalization.

## Binding, features and fail-closed policy
The client requires its actual product App ID, environment=sandbox, SHA-256 installation binding and active status. It checks starts_at when present, expiry when nonnull, signed validation/grace dates and the last accepted checkpoint. Invalid data, status or policy is a refusal even if the payload carries a true feature.
pdf_export is allowed only for the boolean true on a fully accepted result. seat_count is exposed only as a nonnegative integer bounded by the shared safe-integer policy; otherwise it stays null. These example feature names must match your own product configuration. Constructing a result or reading token presence never authenticates a license.

## Offline grace and time checks
Before next_validation_at, check can return a verified cache. After that instant it validates online. Only a transport failure may use the existing signed state within offline_grace_until and expires_at. An explicit HTTP refusal, bad signature, malformed success or binding mismatch cannot extend access. Selected token/revocation/[device](/docs/v1/start/glossary#device)/expiry/cancellation refusals clear the token; other refusals clear cached authorization.
The last accepted checkpoint and signed server_time bound rollback with300 seconds tolerance. Grace is based on its signed deadline, not added to next_validation_at. Validating online does not promise permission if time/status/binding rules fail. No constructor flag creates an extra offline extension.
These strict sample policies are not changes to existing SDK behavior. A person controlling the host can patch the program or restore full snapshots. Use server-side authorization for high-value online actions and do not promise absolute local anti-tamper protection.

## Private storage, concurrency and recovery
The [installation ID](/docs/v1/start/glossary#installation-id) is random, persistent and independent of MAC/serial/hardware fingerprints. A namespaced private session stores the [activation token](/docs/v1/start/glossary#activation-token), lossless [signed envelope](/docs/v1/start/glossary#signed-envelope) and checkpoint. Writes are atomic and permissions are owner-only where supported; this is not automatic encryption or an OS-vault certification.
The program serializes one namespace. Java/Kotlin, Dart, Rust and the POSIX native core use an OS lock on a stable file; Go/Ruby/Swift use exclusive lock-file ownership and require manual reconciliation after a crash. Never delete an active lock or regenerate identity to avoid a refusal. A new identity can consume another cumulative activation. Keep separate namespaces for unrelated buyers/tenants.
Review [secure token storage](/docs/v1/security/secure-token-storage) for native vault adapters. POSIX modes do not replace Windows ACL review. Do not put state under public_html, bundle a populated cache, or expose raw SDK/client methods to a renderer/browser.

## Errors and uncertain mutations
The client accepts only bounded safe error/request identifiers and shows plain user messages. Unknown errors fail closed. No automatic mutation retry is supplied. A lost activation response may already have consumed a server activation; reconcile before retrying. If a returned new token fails signature/policy acceptance, the client attempts best-effort release, which can itself remain uncertain.
Read [the complete server error table](/docs/v1/api/errors). Local example identifiers such as BINDING_MISMATCH, ALREADY_ACTIVATED, SIGNATURE_INVALID and INVALID_TIME are client policy results, not invented server emissions. Never show raw stack traces, private paths or customer payloads to end users.

## Packaging and framework integration
Native CLI or backend, without third-party Go runtime modules. Build for each target and validate its TLS roots/ACLs. Its reusable signature.go is derived from the complete P5 verifier with only the original CLI main and unused os import removed. An exclusive-create lock refuses concurrent writers; reconcile a stale lock after confirming its process ended.
Keep stable state outside executable extraction/install directories. Include the exact verification modules and required native/runtime libraries; never embed a developer key or populated token/cache. A web route still needs application authentication, tenant authorization and CSRF protection. A desktop renderer gets narrow safe decisions only, not arbitrary file paths or token access.
Re-test real activation, cache reload, offline loss, explicit refusal and release after bundling or updating dependencies. macOS native source execution is not proof that every operating-system package, signing/notarization setup or framework UI has passed.

## Recorded verification and limits
The exact native runtime executes the real isolated Sandbox lifecycle and21 negative/positive checks: wrong email, stable cross-process identity, cache without HTTP, online validation, injected network loss, modified offline cache, rollback, explicit HTTP503, modified signed response, no-follow307, recovery, release and unsafe setup guards. Refusal/outage/redirect injections are an explicit loopback test forwarder, not a claimed production outage.
Build evidence records actual toolchain/dependency hashes. All ten fresh project archives build and the complete native clients execute real Sandbox lifecycles. All23 published signature vectors pass in every REST language. Signature authenticity is separate from current license authorization. Native Windows/Linux/mobile GUI execution is not inferred from this macOS run.

## Expected result
Your application authenticates signed state, applies binding/time/status policy and enables only verified features. A refusal or successful seat release cannot accidentally unlock a feature.

## Common mistakes
- Using the internal product ID instead of the Public App ID.
- Losing numeric tokens before verifying the signature.
- Treating a true feature or HTTP success as a validity proof.
- Sharing one installation cache between unrelated tenants or deleting identity on failure.

## Security notes
Keep HTTPS verification, independent key trust and fail-closed policy. This example does not change the platform contract, process payments or grant universal anti-tamper protection. Preserve real API/SDK boundaries and keep credentials off browser/renderer surfaces.

## Troubleshooting
| Symptom | Cause | Action |
| --- | --- | --- |
| Exit2 at startup | Unsafe URL, missing private path, bad identity or busy lock | Correct trusted configuration; do not expose raw diagnostics to users |
| INVALID_LICENSE | Key/email/App ID/environment mismatch | Use the actual matching Sandbox values |
| SIGNATURE_INVALID | Wrong key, modified state or changed canonical bytes | Deny access and run the published vectors |
| OFFLINE_CACHE_MISSING | No accepted signed state remains | Reconnect and validate; never manufacture a cache |
| CLOCK_ROLLBACK_DETECTED | System time behind trusted time | Correct the device clock and reconnect |
| Release uncertain | Lost response or network/server refusal | Preserve identity and reconcile the seat with your software provider |

## Next steps
Review [offline mode](/docs/v1/security/offline-mode), [signed responses](/docs/v1/security/signed-responses) and [API errors](/docs/v1/api/errors).

## Related
- [Activate](/docs/v1/api/activate)
- [Validate](/docs/v1/api/validate)
- [Deactivate](/docs/v1/api/deactivate)
- [Signature test vectors](/docs/v1/security/test-vectors)