---
slug: "/docs/v1/security"
title: "Security reference"
description: "Understand signed decisions, private storage, installation identity and safe failure behavior."
section: "Security"
order: 52
audience: "all"
level: "beginner"
last_updated: "2026-10-20"
version: "v1"
related: []
draft: false
layout: "hub"
---
## What you can do here
Understand signed decisions, private storage, installation identity and safe failure behavior.

- [Signed responses](/docs/v1/security/signed-responses) — Understand the exact Ed25519 envelope, PHP canonical bytes, trusted keys, time checks and replay limits before accepting a [license](/docs/v1/start/glossary#license).
- [Verify Ed25519 signatures](/docs/v1/security/verify-ed25519) — Run independent signature verifiers in fourteen languages with the same lossless JSON contract and shared conformance tests.
- [Signature test vectors](/docs/v1/security/test-vectors) — Download real public-safe Signer vectors and test authenticity separately from expiry, trust and license policy.
- [Offline mode and grace](/docs/v1/security/offline-mode) — Configure real SDK cache and grace behavior, test connection failures safely and understand revocation and clock limitations.
- [Entitlements and features](/docs/v1/security/entitlements-and-features) — Define product-plan features, enforce boolean and numeric entitlements safely and understand cached plan changes.
- [Threat model](/docs/v1/security/threat-model) — Understand licensing trust boundaries, attacker capabilities, implemented controls and limits on customer-controlled machines.
- [Application hardening](/docs/v1/security/hardening) — Combine realistic code signing, short validation policies, server authorization and tamper-evident operational records.
- [Secure token storage](/docs/v1/security/secure-token-storage) — Choose native token storage by operating system and language, with explicit SDK fallbacks and tested helper examples.
- [Installation identity](/docs/v1/security/installation-id) — Generate a random stable [installation ID](/docs/v1/start/glossary#installation-id) without hardware fingerprints and recover safely after reinstall or state loss.
- [API key security and leak response](/docs/v1/security/api-key-leak-response) — [Scope](/docs/v1/start/glossary#scope) management credentials and respond to a leak with immediate revocation, request-ID investigation and controlled recovery.
- [Webhook security](/docs/v1/security/webhook-security) — Verify exact raw HMAC bytes, reject stale or duplicate events and coordinate endpoint-secret rotation safely.
- [Developer data protection responsibilities](/docs/v1/security/developer-data-protection) — Understand actual [customer](/docs/v1/start/glossary#customer) data, export and retention controls without mistaking pseudonymisation or account closure for complete erasure.
- [Security and responsible disclosure](/security) — Review [KDPika Licensing](/docs/v1/start/glossary#kdpika-licensing)'s implemented controls, known limits and safe vulnerability-reporting contact.

## Next steps
[Follow the Complete Integration Guide](/docs/v1/integration-guide)