KDPika Licensing
Sign inStart freeChoose a client by runtime and trust model, then test the exact package before distributing your integration.
All languages
Official SDK source packages handle the client lifecycle and signed decisions, subject to the documented compatibility limits. REST projects are lower-level integration examples, not additional official SDKs.
Official SDK source packages
REST client projects
My language is not listed: build a client. Your client must verify signatures and semantic bindings before allowing access.
What you will learn
- Distinguish four official SDKs from native REST examples.
- Verify package source/checksums and runtime requirements.
- Understand version, platform, storage and known release limitations.
Prerequisites
- Complete the quickstart.
- Read authentication and signature verification.
Choose an integration
Use an official SDK when its runtime matches your application and its documented release limitations are acceptable. These four packages handle customer installation licensing, not developer management or your software-buyer payments. Keep lmp_ developer keys on your trusted backend. REST programs are not additional official SDK packages.
| Language | Package identity | Version label | Declared minimum | Actual requirement / boundary | Application model |
|---|---|---|---|---|---|
| python | kdpika-licensing | 1.1.5 | >=3.11,<3.15 | Python 3.11–3.14 | PyPI package; import kdpika_licensing |
| php | kdpika/license-sdk | 1.0.0 | ^8.1 | PHP8.2+ (readonly result class) | Composer PSR-4 backend library |
| javascript | @kdpika/license-sdk | 1.0.0 | >=18 | Node18+; test each deployed runtime | module; Node/Electron main process only |
| csharp | KDPika.LicenseSdk | 1.0.0 | net7.0 | .NET7+ compatible target; prefer maintained runtime | C# project reference; async client |
Python 1.1.5 is published on PyPI with MIT-licensed GitHub source. Install with python -m pip install "kdpika-licensing==1.1.5". PHP, JavaScript and C# remain direct source distributions; no npm, Packagist or NuGet publication is claimed.
The PHP version label comes from the existing download filename; composer.json has no version field. Its ^8.1 declaration conflicts with the readonly result class, which needs PHP 8.2+. C# targets net7.0; this is not a promise that .NET 7 remains vendor-supported. Choose a maintained deployment runtime and test compatibility.
Download and verify
| Language | Source ZIP | Bytes | SHA-256 |
|---|---|---|---|
| python | kdpika-python-sdk-1.1.5.zip | 151872 | f8389b804510b7a38ba299793a0a2aba2d55eba147d37a682cd94b39d08a5a05 |
| php | kdpika-php-sdk-1.0.0.zip | 16532 | fd6a1ca7c2111fcbbe090f0065e1ee9bc70a439904bf1b049234e49c7ba2f108 |
| javascript | kdpika-javascript-sdk-1.0.0.zip | 14854 | d0f3fd6c10e3264eebe37bfa5bb1e6ef7ddabe3a3acb37fc3ffd9a0d5b518d30 |
| csharp | kdpika-csharp-sdk-1.0.0.zip | 16422 | cc9a591ab5b3a23ed7b172c5e67cbc92dad0f0c773d853e00c2e6da3c588d9d7 |
Each ZIP has one kdpika-LANGUAGE-sdk top-level directory and the exact package source, tests and documentation. Generated obj/bin, node_modules, vendor, caches, private credentials and machine files are excluded. The hashes cover the downloadable ZIP bytes, not an unrelated package-manager registry artifact.
- Download the ZIP for your language from this page. Expected: the versioned filename in the table.
- Calculate SHA-256 before extracting. Expected: the full digest exactly matches the table; otherwise stop and download again from the official site.
- Extract into a clean project directory. Expected: a single SDK directory, with its package metadata and src/project files.
- Follow the relevant language guide and pin your application dependencies. Expected: your build uses this exact source, not an unverified registry package.
On macOS use shasum -a 256 with the downloaded filename. On Linux use sha256sum. On Windows use Get-FileHash -Algorithm SHA256. A matching checksum detects accidental drift against this HTTPS page; it is not an independent publisher signature or a license grant.
Platform and trust boundaries
The source is intended for Windows, macOS and Linux where the selected runtime, TLS trust store and dependencies are supported. Python 1.1.5 core checks passed across Python 3.11–3.14 on Windows, Linux and Intel macOS; a fresh PyPI install also passed on Apple Silicon. The other SDKs retain their recorded source-test boundaries. GUI frameworks have their own platform limits.
Python can prefer an available OS keyring. PHP, Node and C# use permission-protected files, not automatic Keychain/DPAPI/Secret Service protection. See the tested storage adapters. No SDK is safe to expose as unrestricted browser management code. Electron uses its main process and a narrow authenticated IPC boundary.
Installation identity is random and persistent. Activation also sends a descriptive device name/platform/app version from the runtime; that can include a machine hostname. Do not claim no device metadata is collected. Neither an installed package nor its stored token proves the current license is valid.
Release limitations to test
JavaScript loses PHP integral-float spellings such as 19.0 during JSON serialization. C# cache serialization can change Unicode encoding. Those earlier Python 1.0.0 canonicalization defects were corrected in Python 1.1.5; use the current package, not the retained legacy archive. These can reject a real valid server signature. They are not permission to bypass Ed25519, strip signed fields or re-sign on the client.
All feature helpers must be used only after a valid result. A failed result can still carry signed features; validity/status/time/environment/installation rules remain essential. A successful deactivation has valid=true for the release operation but does not authorize a protected feature.
No historical signing-key ring or automatic overlap is supplied. Pinned-key updates require a controlled application rollout. Offline cache acceptance is bounded by signed grace/expiry and clock checks, not unlimited offline access.
Package licensing and version policy
Python 1.1.5 is MIT-licensed. PHP/JavaScript metadata remains proprietary; C# has no package license field. Non-Python source ZIPs retain their LICENSE information notices and observed-version CHANGELOG files. The Python archive comes from the exact verified PyPI source release. Those notices do not invent an open-source or redistribution grant. Contact hi@kdpika.com for the applicable permission/terms before redistribution. The legacy PHP repository test retains its original autoload assumption; tests/standalone.php is the new package-local entry with the same assertions and no SDK behavior change.
The current Python release is 1.1.5; the other source SDK labels remain 1.0.0. Do not infer older releases, a support-duration SLA or an SDK compatibility promise from a filename. Application maintainers should pin the version/hash, compare the API surface and execute the signed-byte/cache/offline/refusal tests before upgrades. API v1 and SDK package versions are independent.
Expected result
Your application handles explicit refusal without enabling features, preserves the installation identity, and deactivates deliberately when releasing a seat. Check the real signed result, not only a transport status.
Common mistakes
- Assuming a named registry release exists because a package name is shown.
- Treating PHP 8.1 or every native OS as tested.
- Enabling features from result payloads without a validity check.
Security notes
Never ship a developer API key or disable signature/TLS verification. ZIP checksums are integrity metadata, not an open-source grant or proof that a local app cannot be patched.
Troubleshooting
| Symptom | Cause | Action |
|---|---|---|
| Checksum differs | Wrong version, incomplete download or changed source | Stop; compare the exact current filename/digest |
| PHP parse error on 8.1 | readonly class requires 8.2 | Use supported source runtime; do not ignore the declaration mismatch |
| Signature rejected | Actual release compatibility issue or tampering | Deny access and run the published vectors |
Next steps
Review the Sandbox quickstart, signed responses and error handling.