Licenses

Svitrio can act as a license authority for your product: each project holds an Ed25519 signing key and stamps a signed, offline-verifiable token into every license. Your product verifies with the project’s public key — no call home needed — and can optionally poll a status endpoint to observe revocation. Opt-in per project.

Products & licenses

Define products, then issue licenses with a public_ref like LIC-7GK2MQ, a plan, seats, customer details and an optional expiry. A license’s status (active / suspended / revoked) moves only through a state machine (POST /licenses/{id}/transition); expired is derived at verify time, never stored.

Formats

The same signed claims can be delivered three ways, auto-detected on verify:

• svl1 — a compact svl1.<payload>.<sig> token (the version tag is inside the signed region, blocking downgrade).

• jwt — an EdDSA JWT (RFC 8037); only EdDSA is accepted, closing algorithm-confusion attacks.

• x509 — a PEM leaf signed by the project’s self-signed CA, with the claims in a certificate extension.

Verification surfaces

Public, unauthenticated: GET /api/p/{ref}/licenses/status?ref=LIC-… (revocation), /licenses/jwks (verify JWT format) and /licenses/ca.pem (verify x509 format).