Licensing in Any Language

The Auris Licensing API is a standard REST/JSON API. You don’t need an SDK — any language that can make an HTTP POST and parse JSON can validate licenses, activate devices, and gate features.

If you’re using JavaScript/TypeScript, use the @auris/js SDK instead — it handles offline fallback and revocation caching automatically.

The Only Endpoint You Need

POST https://your-auris-domain/api/licensing/validate


// Request
{
  "key": "VIG-A8BC-D3EF-G4HJ-K5LM"
}
 
// Response (valid)
{
  "valid": true,
  "features": ["threat-intel", "vuln-scan"],
  "seats": { "used": 1, "max": 5 },
  "expiresAt": "2027-03-15T00:00:00Z"
}
 
// Response (invalid)
{
  "valid": false,
  "reason": "EXPIRED"
}

Headers: Content-Type: application/json and x-tenant: your-tenant-id (optional, defaults to your-tenant-id).

No Bearer token needed. This is a public endpoint.

Language Examples

C#

C# (.NET)


using System.Net.Http;
using System.Text;
using System.Text.Json;
 
public record LicenseResult(bool Valid, string? Reason, string[]? Features, DateTime? ExpiresAt);
 
public class AurisLicense
{
    private static readonly HttpClient _http = new();
    private readonly string _baseUrl;
    private readonly string _tenant;
 
    public AurisLicense(string domain, string tenant = "your-tenant-id")
    {
        _baseUrl = $"https://{domain}";
        _tenant = tenant;
    }
 
    public async Task<LicenseResult> ValidateAsync(string key)
    {
        var request = new HttpRequestMessage(HttpMethod.Post, $"{_baseUrl}/api/licensing/validate")
        {
            Content = new StringContent(
                JsonSerializer.Serialize(new { key }),
                Encoding.UTF8, "application/json")
        };
        request.Headers.Add("x-tenant", _tenant);
 
        var response = await _http.SendAsync(request);
        var json = await response.Content.ReadAsStringAsync();
        return JsonSerializer.Deserialize<LicenseResult>(json,
            new JsonSerializerOptions { PropertyNameCaseInsensitive = true })!;
    }
 
    public async Task ActivateAsync(string key, string fingerprint, string? name = null)
    {
        var request = new HttpRequestMessage(HttpMethod.Post, $"{_baseUrl}/api/licensing/activate")
        {
            Content = new StringContent(
                JsonSerializer.Serialize(new { key, fingerprint, name }),
                Encoding.UTF8, "application/json")
        };
        request.Headers.Add("x-tenant", _tenant);
 
        var response = await _http.SendAsync(request);
        if (!response.IsSuccessStatusCode)
            throw new Exception($"Activation failed: {response.StatusCode}");
    }
 
    public async Task DeactivateAsync(string key, string fingerprint)
    {
        var request = new HttpRequestMessage(HttpMethod.Post, $"{_baseUrl}/api/licensing/deactivate")
        {
            Content = new StringContent(
                JsonSerializer.Serialize(new { key, fingerprint }),
                Encoding.UTF8, "application/json")
        };
        request.Headers.Add("x-tenant", _tenant);
        await _http.SendAsync(request);
    }
}

Usage:


var license = new AurisLicense("auth.yourdomain.com", "your-tenant-id");
 
// Validate
var result = await license.ValidateAsync("VIG-A8BC-D3EF-G4HJ-K5LM");
if (result.Valid)
{
    Console.WriteLine($"Valid! Features: {string.Join(", ", result.Features ?? [])}");
}
 
// Activate device
await license.ActivateAsync("VIG-A8BC-D3EF-G4HJ-K5LM", GetMachineId(), Environment.MachineName);
 
// Feature gating
if (result.Features?.Contains("threat-intel") == true)
{
    // Enable threat intel module
}

Rust

Using reqwest and serde:


# Cargo.toml
[dependencies]
reqwest = { version = "0.12", features = ["json"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
tokio = { version = "1", features = ["full"] }


use serde::{Deserialize, Serialize};
 
#[derive(Debug, Deserialize)]
pub struct LicenseResult {
    pub valid: bool,
    pub reason: Option<String>,
    pub features: Option<Vec<String>>,
    #[serde(rename = "expiresAt")]
    pub expires_at: Option<String>,
}
 
pub struct AurisLicense {
    base_url: String,
    tenant: String,
    client: reqwest::Client,
}
 
impl AurisLicense {
    pub fn new(domain: &str, tenant: &str) -> Self {
        Self {
            base_url: format!("https://{domain}"),
            tenant: tenant.to_string(),
            client: reqwest::Client::new(),
        }
    }
 
    pub async fn validate(&self, key: &str) -> Result<LicenseResult, reqwest::Error> {
        self.client
            .post(format!("{}/api/licensing/validate", self.base_url))
            .header("x-tenant", &self.tenant)
            .json(&serde_json::json!({ "key": key }))
            .send()
            .await?
            .json()
            .await
    }
 
    pub async fn activate(
        &self, key: &str, fingerprint: &str, name: Option<&str>,
    ) -> Result<(), reqwest::Error> {
        let res = self.client
            .post(format!("{}/api/licensing/activate", self.base_url))
            .header("x-tenant", &self.tenant)
            .json(&serde_json::json!({ "key": key, "fingerprint": fingerprint, "name": name }))
            .send()
            .await?;
 
        if !res.status().is_success() {
            panic!("Activation failed: {}", res.status());
        }
        Ok(())
    }
 
    pub async fn deactivate(&self, key: &str, fingerprint: &str) -> Result<(), reqwest::Error> {
        self.client
            .post(format!("{}/api/licensing/deactivate", self.base_url))
            .header("x-tenant", &self.tenant)
            .json(&serde_json::json!({ "key": key, "fingerprint": fingerprint }))
            .send()
            .await?;
        Ok(())
    }
}

Usage:


#[tokio::main]
async fn main() {
    let license = AurisLicense::new("auth.yourdomain.com", "your-tenant-id");
 
    let result = license.validate("VIG-A8BC-D3EF-G4HJ-K5LM").await.unwrap();
 
    if result.valid {
        println!("Valid! Features: {:?}", result.features);
    } else {
        println!("Invalid: {:?}", result.reason);
    }
 
    // Feature gating
    if result.features.as_ref().map_or(false, |f| f.contains(&"threat-intel".to_string())) {
        // Enable threat intel module
    }
}

C/C++

C / C++

Using libcurl and cJSON (or any JSON parser):


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <curl/curl.h>
#include "cJSON.h"
 
typedef struct {
    int valid;
    char reason[64];
    char features[512];
    char expires_at[32];
} LicenseResult;
 
// Simple response buffer
struct Buffer {
    char *data;
    size_t size;
};
 
static size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata) {
    struct Buffer *buf = (struct Buffer *)userdata;
    size_t total = size * nmemb;
    buf->data = realloc(buf->data, buf->size + total + 1);
    memcpy(buf->data + buf->size, ptr, total);
    buf->size += total;
    buf->data[buf->size] = '\0';
    return total;
}
 
int auris_validate(const char *domain, const char *tenant, const char *key, LicenseResult *out) {
    CURL *curl = curl_easy_init();
    if (!curl) return -1;
 
    char url[512];
    snprintf(url, sizeof(url), "https://%s/api/licensing/validate", domain);
 
    char body[256];
    snprintf(body, sizeof(body), "{\"key\":\"%s\"}", key);
 
    struct curl_slist *headers = NULL;
    headers = curl_slist_append(headers, "Content-Type: application/json");
 
    char tenant_header[128];
    snprintf(tenant_header, sizeof(tenant_header), "x-tenant: %s", tenant);
    headers = curl_slist_append(headers, tenant_header);
 
    struct Buffer response = { .data = malloc(1), .size = 0 };
 
    curl_easy_setopt(curl, CURLOPT_URL, url);
    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, body);
    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response);
    curl_easy_setopt(curl, CURLOPT_TIMEOUT, 5L);
 
    CURLcode res = curl_easy_perform(curl);
    curl_slist_free_all(headers);
    curl_easy_cleanup(curl);
 
    if (res != CURLE_OK) {
        free(response.data);
        return -1;
    }
 
    // Parse JSON response
    cJSON *json = cJSON_Parse(response.data);
    free(response.data);
 
    if (!json) return -1;
 
    cJSON *valid = cJSON_GetObjectItem(json, "valid");
    out->valid = cJSON_IsTrue(valid);
 
    cJSON *reason = cJSON_GetObjectItem(json, "reason");
    if (reason && cJSON_IsString(reason))
        strncpy(out->reason, reason->valuestring, sizeof(out->reason) - 1);
 
    cJSON *features = cJSON_GetObjectItem(json, "features");
    out->features[0] = '\0';
    if (features && cJSON_IsArray(features)) {
        cJSON *f;
        cJSON_ArrayForEach(f, features) {
            if (cJSON_IsString(f)) {
                if (out->features[0]) strcat(out->features, ",");
                strcat(out->features, f->valuestring);
            }
        }
    }
 
    cJSON_Delete(json);
    return 0;
}

Usage:


int main() {
    curl_global_init(CURL_GLOBAL_DEFAULT);
 
    LicenseResult result;
    if (auris_validate("auth.yourdomain.com", "your-tenant-id", "VIG-A8BC-D3EF-G4HJ-K5LM", &result) == 0) {
        if (result.valid) {
            printf("License valid! Features: %s\n", result.features);
        } else {
            printf("License invalid: %s\n", result.reason);
        }
    }
 
    // Feature gating
    if (result.valid && strstr(result.features, "threat-intel")) {
        // Enable threat intel module
    }
 
    curl_global_cleanup();
    return 0;
}

C++ (with httplib + nlohmann/json):


#include <httplib.h>
#include <nlohmann/json.hpp>
 
using json = nlohmann::json;
 
struct LicenseResult {
    bool valid;
    std::string reason;
    std::vector<std::string> features;
    std::string expires_at;
};
 
LicenseResult auris_validate(const std::string& domain, const std::string& key) {
    httplib::Client cli(domain);
    json body = {{"key", key}};
 
    auto res = cli.Post("/api/licensing/validate",
        {{"Content-Type", "application/json"}, {"x-tenant", "your-tenant-id"}},
        body.dump(), "application/json");
 
    LicenseResult result{};
    if (res && res->status == 200) {
        auto j = json::parse(res->body);
        result.valid = j.value("valid", false);
        result.reason = j.value("reason", "");
        if (j.contains("features"))
            result.features = j["features"].get<std::vector<std::string>>();
        result.expires_at = j.value("expiresAt", "");
    }
    return result;
}

Go


package auris
 
import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"time"
)
 
type LicenseResult struct {
	Valid     bool     `json:"valid"`
	Reason   string   `json:"reason,omitempty"`
	Features []string `json:"features,omitempty"`
	Seats    *struct {
		Used int  `json:"used"`
		Max  *int `json:"max"`
	} `json:"seats,omitempty"`
	ExpiresAt *string `json:"expiresAt,omitempty"`
}
 
type License struct {
	baseURL string
	tenant  string
	client  *http.Client
}
 
func NewLicense(domain, tenant string) *License {
	return &License{
		baseURL: fmt.Sprintf("https://%s", domain),
		tenant:  tenant,
		client:  &http.Client{Timeout: 5 * time.Second},
	}
}
 
func (l *License) Validate(key string) (*LicenseResult, error) {
	body, _ := json.Marshal(map[string]string{"key": key})
	req, _ := http.NewRequest("POST", l.baseURL+"/api/licensing/validate", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("x-tenant", l.tenant)
 
	resp, err := l.client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
 
	var result LicenseResult
	json.NewDecoder(resp.Body).Decode(&result)
	return &result, nil
}
 
func (l *License) Activate(key, fingerprint, name string) error {
	body, _ := json.Marshal(map[string]string{"key": key, "fingerprint": fingerprint, "name": name})
	req, _ := http.NewRequest("POST", l.baseURL+"/api/licensing/activate", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("x-tenant", l.tenant)
 
	resp, err := l.client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
 
	if resp.StatusCode >= 400 {
		return fmt.Errorf("activation failed: %d", resp.StatusCode)
	}
	return nil
}

Usage:


func main() {
    lic := auris.NewLicense("auth.yourdomain.com", "your-tenant-id")
 
    result, err := lic.Validate("VIG-A8BC-D3EF-G4HJ-K5LM")
    if err != nil {
        log.Fatal(err)
    }
 
    if result.Valid {
        fmt.Println("Valid! Features:", result.Features)
    }
 
    // Feature gating
    for _, f := range result.Features {
        if f == "threat-intel" {
            // Enable threat intel
        }
    }
}

Python


import requests
from dataclasses import dataclass
from typing import Optional
 
@dataclass
class LicenseResult:
    valid: bool
    reason: Optional[str] = None
    features: list[str] = None
    expires_at: Optional[str] = None
 
class AurisLicense:
    def __init__(self, domain: str, tenant: str = "your-tenant-id"):
        self.base_url = f"https://{domain}"
        self.tenant = tenant
 
    def validate(self, key: str) -> LicenseResult:
        res = requests.post(
            f"{self.base_url}/api/licensing/validate",
            json={"key": key},
            headers={"x-tenant": self.tenant},
            timeout=5,
        )
        data = res.json()
        return LicenseResult(
            valid=data.get("valid", False),
            reason=data.get("reason"),
            features=data.get("features", []),
            expires_at=data.get("expiresAt"),
        )
 
    def activate(self, key: str, fingerprint: str, name: str = None):
        res = requests.post(
            f"{self.base_url}/api/licensing/activate",
            json={"key": key, "fingerprint": fingerprint, "name": name},
            headers={"x-tenant": self.tenant},
            timeout=5,
        )
        res.raise_for_status()
 
    def deactivate(self, key: str, fingerprint: str):
        requests.post(
            f"{self.base_url}/api/licensing/deactivate",
            json={"key": key, "fingerprint": fingerprint},
            headers={"x-tenant": self.tenant},
            timeout=5,
        )

Usage:


license = AurisLicense("auth.yourdomain.com", "your-tenant-id")
 
result = license.validate("VIG-A8BC-D3EF-G4HJ-K5LM")
 
if result.valid:
    print(f"Valid! Features: {result.features}")
 
    if "threat-intel" in result.features:
        # Enable threat intel module
        pass
else:
    print(f"Invalid: {result.reason}")

Java


import java.net.URI;
import java.net.http.*;
import java.net.http.HttpResponse.BodyHandlers;
import com.google.gson.*;
 
public class AurisLicense {
    private final String baseUrl;
    private final String tenant;
    private final HttpClient client = HttpClient.newHttpClient();
    private final Gson gson = new Gson();
 
    public AurisLicense(String domain, String tenant) {
        this.baseUrl = "https://" + domain;
        this.tenant = tenant;
    }
 
    public record LicenseResult(
        boolean valid, String reason, String[] features, String expiresAt
    ) {}
 
    public LicenseResult validate(String key) throws Exception {
        var body = gson.toJson(java.util.Map.of("key", key));
        var request = HttpRequest.newBuilder()
            .uri(URI.create(baseUrl + "/api/licensing/validate"))
            .header("Content-Type", "application/json")
            .header("x-tenant", tenant)
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();
 
        var response = client.send(request, BodyHandlers.ofString());
        return gson.fromJson(response.body(), LicenseResult.class);
    }
 
    public void activate(String key, String fingerprint, String name) throws Exception {
        var body = gson.toJson(java.util.Map.of(
            "key", key, "fingerprint", fingerprint, "name", name
        ));
        var request = HttpRequest.newBuilder()
            .uri(URI.create(baseUrl + "/api/licensing/activate"))
            .header("Content-Type", "application/json")
            .header("x-tenant", tenant)
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();
 
        var response = client.send(request, BodyHandlers.ofString());
        if (response.statusCode() >= 400)
            throw new RuntimeException("Activation failed: " + response.statusCode());
    }
}

Usage:


var license = new AurisLicense("auth.yourdomain.com", "your-tenant-id");
 
var result = license.validate("VIG-A8BC-D3EF-G4HJ-K5LM");
 
if (result.valid()) {
    System.out.println("Valid! Features: " + String.join(", ", result.features()));
}
 
// Feature gating
if (result.valid() && java.util.Arrays.asList(result.features()).contains("threat-intel")) {
    // Enable threat intel
}

curl

For testing or shell scripts:


# Validate
curl -s -X POST https://auth.yourdomain.com/api/licensing/validate \
  -H "Content-Type: application/json" \
  -H "x-tenant: your-tenant-id" \
  -d '{"key": "VIG-A8BC-D3EF-G4HJ-K5LM"}' | jq
 
# Activate device
curl -s -X POST https://auth.yourdomain.com/api/licensing/activate \
  -H "Content-Type: application/json" \
  -H "x-tenant: your-tenant-id" \
  -d '{"key": "VIG-A8BC-D3EF-G4HJ-K5LM", "fingerprint": "abc123", "name": "Dev Machine"}'
 
# Deactivate device
curl -s -X POST https://auth.yourdomain.com/api/licensing/deactivate \
  -H "Content-Type: application/json" \
  -H "x-tenant: your-tenant-id" \
  -d '{"key": "VIG-A8BC-D3EF-G4HJ-K5LM", "fingerprint": "abc123"}'

Offline Validation (JWT)

When a key is issued, it comes with a jwtToken — a signed JWT containing the entitlements. For offline validation without the SDK, decode the JWT payload (base64url) and check:

Expiry: exp claim (Unix timestamp) must be in the future
Revocation: Fetch /api/licensing/revocation-list periodically and check if the JWT’s jti is in the revoked list
Entitlements: auris_lic.features, auris_lic.seats.max, auris_lic.devices.max


// JWT payload (decoded)
{
  "jti": "key_abc123",
  "iss": "auris",
  "sub": "VIG-A8BC-D3EF-G4HJ-K5LM",
  "exp": 1804723200,
  "auris_lic": {
    "features": ["threat-intel", "vuln-scan"],
    "seats": { "max": 5 },
    "devices": { "max": 3 }
  }
}

For full offline validation with signature verification, use the Auris public key from /api/.well-known/jwks.json. Most languages have JWT libraries (e.g. System.IdentityModel.Tokens.Jwt for C#, jsonwebtoken crate for Rust, golang-jwt for Go).

Device Fingerprinting

For device-based licensing, generate a stable machine identifier:

Language	Method
C#	`System.Management` → `Win32_ComputerSystemProduct.UUID` or `Environment.MachineName`
Rust	`machine-uid` crate or `/etc/machine-id` on Linux
C/C++	`/etc/machine-id` (Linux), `IOPlatformUUID` (macOS), `MachineGuid` registry (Windows)
Go	`github.com/denisbrodbeck/machineid`
Python	`uuid.getnode()` or `platform.node()`
Java	`InetAddress.getLocalHost().getHostName()` + MAC address

The fingerprint just needs to be a stable string unique to the machine. Send it to activate and deactivate.

Summary

The pattern is the same in every language:


1. POST /api/licensing/validate  {"key": "..."}  → {valid, features, seats, ...}
2. POST /api/licensing/activate  {"key": "...", "fingerprint": "..."}  → 200 OK
3. POST /api/licensing/deactivate  {"key": "...", "fingerprint": "..."}  → 200 OK

Three endpoints. No SDK required. No API key. No Bearer token. Just HTTP + JSON.