key/check

Validate a license key and get a signed response.

key/check

Validates a license key for a given hardware ID and returns an Ed25519-signed response.

Request

POST /api/v1/key/check

Headers:

Header	Value
X-Project-Key	pk-... (required)
Content-Type	application/json

Body:

Field	Type	Required	Notes
key	string	yes	The license key to validate.
hwid	string	yes	Hardware ID from the client. Passthrough: Vampauth compares only.
nonce	string	yes	Client-generated random value, at most 128 chars. Fresh per call. The server only echoes and signs it — see Nonce.

{
  "key": "DP3P-YDMA-NJDI-HJJC",
  "hwid": "my-hwid",
  "nonce": "abc123"
}

Success response

HTTP 200

{
  "status": "valid",
  "key": "DP3P-YDMA-NJDI-HJJC",
  "hwid_bound": true,
  "expires_at": "2026-08-15T14:56:04.493Z",
  "nonce_echo": "abc123",
  "signature": "VKJ9UnMY...",
  "project_id": "df7c4445-..."
}

Field	Type	Notes
status	string	valid
key	string	The validated key.
hwid_bound	boolean	Whether this key is bound to the provided hwid.
expires_at	string or null	Key expiry, ISO 8601. Null when it never expires.
nonce_echo	string	Echo of the request nonce.
signature	string	Base64 Ed25519 signature. See Signature verification.
project_id	string	The project this key belongs to.

Every successful call increments the key’s usage stats (executions, last_used) and persists them.

Errors

HTTP	error	Meaning
400	INVALID_REQUEST	Missing or malformed body field, or nonce too long.
401	UNAUTHORIZED	Missing or invalid X-Project-Key.
403	KEY_BANNED	Key revoked or banned.
403	FINGERPRINT_MISMATCH	Key is bound to different hardware.
404	KEY_NOT_FOUND	No such key.
410	KEY_EXPIRED	Key has expired.
429	RATE_LIMITED	Too many requests. Retry after retry_after.

Error body:

{
  "error": "FINGERPRINT_MISMATCH",
  "message": "This key is locked to different hardware."
}