divinerapier-license-client

The official, zero-dependency (except jose) Client SDK for integrating with the Divine Rapier License Server. This SDK enables robust cryptographic offline JWT verification to protect your Next.js, Node.js, Electron, or React applications against software piracy.

Installation

npm install divinerapier-license-client

Quick Start

1. Initialization

Grab your server URL and the LIC_PUBLIC_KEY from your server's .env.local file. Hardcode this Public Key directly into your client application.

import { DivineRapierClient } from 'divinerapier-license-client';

const licensing = new DivineRapierClient({
    serverUrl: 'https://divinerapier.vercel.app',
    publicKey: `-----BEGIN PUBLIC KEY-----\nMCOwBQYDK2VwAyEAtMD1FZRTCmaoOw/ARP6fcWFXBpO8tOsvFDDjPNPr9uQ=\n-----END PUBLIC KEY-----`
});

2. Activating a License (Online)

When the user installs your software for the first time, ask them for their License Key and register their machine's Domain or Hardware ID. Note: Due to anti-fraud measures, activations are strictly permanent. A license bound to a specific HWID/Domain cannot be deactivated or transferred by the user.

try {
    const activation = await licensing.activate('XYZZ-ABCD-1234', 'client-domain.com');
    
    // Save the offline token locally (localStorage, File System, Database)
    localStorage.setItem('license_token', activation.offline_token);
    console.log("Success! You are now activated.");

} catch (error) {
    console.error("Activation Failed:", error.message);
}

3. Verifying the License (Offline & Instant)

Run this check every time your application boots or a protected route is requested. Because it relies on Asymmetric EdDSA Cryptography, it runs entirely locally in exactly 1-2 milliseconds without pinging the server.

try {
    const savedToken = localStorage.getItem('license_token');
    
    // Validates the cryptographic signature, the expiration date, and the bound domain.
    const payload = await licensing.verifyOffline(savedToken, {
        expectedDomain: 'client-domain.com'
    });
    
    console.log("License is Valid! Launching App...");

} catch (error) {
    // Throws an error if expired, tampered with, or domain mismatches.
    console.error("Access Denied:", error.message);
    // Redirect to activation page / shut down app
}

4. Hardware Fingerprinting (Security Best Practice)

To prevent device spoofing, combine multiple hardware serials into a single deterministic SHA-256 hash using the built-in SDK utility.

import { generateFingerprint } from 'divinerapier-license-client';

// Example: Gather serials from your application environment (e.g. via systeminformation/wmi)
const cpuSerial = "CPU-12345";
const macAddress = "00:1B:44:11:3A:B7";
const diskSerial = "WD-WCC6Y6X";

const secureHwid = await generateFingerprint([cpuSerial, macAddress, diskSerial]);
// Returns: "a1b2c3d4..."

// Use this secureHwid during Activation
const response = await licensing.activate('XYZZ-ABCD-1234', null, secureHwid);

// Use this secureHwid during Offline Validation
const payload = await licensing.verifyOffline(offlineToken, {
  expectedHwid: secureHwid
});

TypeScript Support

This SDK provides first-class TypeScript support. The verifyOffline method strictly returns a LicensePayload interface, ensuring you get autocomplete for licenseId, domain, and hwid.

Security Best Practices

• Do NOT put your LIC_PRIVATE_KEY inside the client application. Only the LIC_PUBLIC_KEY belongs here.
• Obfuscate your client application code before distributing it to customers to prevent them from simply removing the verifyOffline() function call.