授权验证接口

# 下载单文件 SDK（三选一）
curl -O https://shop.example.com/developers/sdk/keyvault.ts
curl -O https://shop.example.com/developers/sdk/keyvault.py
curl -O https://shop.example.com/developers/sdk/keyvault.go

import { KeyVaultClient, KeyVaultError, getDeviceId } from "./keyvault";

const APP_ID = "app_7kq2m9xw4hnp";
const kv = new KeyVaultClient({
  baseUrl: "https://shop.example.com",
  appId: APP_ID,
  appSecret: process.env.KV_APP_SECRET!,
  publicKey: "MCowBQYDK2VwAyEA…", // 下方「获取公钥」里复制，随客户端发布
});
const deviceId = getDeviceId(APP_ID);

// 1. 用户输入授权码后激活
await kv.activate({ licenseKey, deviceId, deviceName: os.hostname() });

// 2. 每次启动、以及运行中每隔几小时校验一次；断网时自动使用离线缓存
try {
  const state = await kv.check({ licenseKey, deviceId });
  unlockFeatures(state.expiresAt);
} catch (err) {
  if (err instanceof KeyVaultError) showActivationScreen(err.message);
}

APP_ID="app_7kq2m9xw4hnp"
APP_SECRET="你的 App Secret"

# kv <接口名> <JSON 请求体>：签名并发送，后面的 cURL 示例都用它
kv() {
  local ts nonce sig
  ts=$(date +%s)
  nonce=$(openssl rand -hex 16)
  sig=$(printf '%s\n%s\n%s' "$ts" "$nonce" "$2" \
    | openssl dgst -sha256 -hmac "$APP_SECRET" | awk '{print $NF}')
  curl -s "https://shop.example.com/api/v1/licenses/$1" \
    -H "Content-Type: application/json" \
    -H "X-KV-App-Id: $APP_ID" \
    -H "X-KV-Timestamp: $ts" \
    -H "X-KV-Nonce: $nonce" \
    -H "X-KV-Signature: $sig" \
    --data-binary "$2"
}

# kv 函数见「认证与请求签名 → 计算签名」
kv activate '{
  "licenseKey": "DSP-7KQ2-M9XW-4HNP-R3TA",
  "deviceId": "3f2a9c0d8e7b6a5f4e3d2c1b0a998877",
  "deviceName": "MacBook Pro",
  "platform": "macOS 26.1",
  "appVersion": "3.2.0"
}'

{
  "ok": true,
  "data": {
    "action": "activate",
    "activated": true,
    "activatedAt": 1792641600,
    "activeDevices": 1,
    "appId": "app_7kq2m9xw4hnp",
    "deviceId": "3f2a9c0d8e7b6a5f4e3d2c1b0a998877",
    "expiresAt": 1824177600,
    "keyFingerprint": "9b74c9897bac770ffc029102a200c5de1f4f7b5c8c2e1d6f0a3b4c5d6e7f8091",
    "maxDevices": 2,
    "status": "active",
    "validUntil": 1792900800
  },
  "signedAt": 1792641600,
  "signature": "q8LxS1v0m2Yc3Gz7Jt5Wd9Rk4Hn6Bp2Ue8Af0Ci3Xo5Ls7Nq1Mv4Tz6Ry9Pw2Eb8Kj3Dh5Fg7Ua0Sc4Lz1Ow=="
}

kv verify '{"licenseKey":"DSP-7KQ2-M9XW-4HNP-R3TA","deviceId":"3f2a9c0d8e7b6a5f4e3d2c1b0a998877","appVersion":"3.2.0"}'

{
  "ok": true,
  "data": {
    "action": "verify",
    "activated": true,
    "activatedAt": 1792641600,
    "activeDevices": 2,
    "appId": "app_7kq2m9xw4hnp",
    "deviceId": "3f2a9c0d8e7b6a5f4e3d2c1b0a998877",
    "expiresAt": 1824177600,
    "keyFingerprint": "9b74c9897bac770ffc029102a200c5de1f4f7b5c8c2e1d6f0a3b4c5d6e7f8091",
    "maxDevices": 2,
    "status": "active",
    "validUntil": 1792900800
  },
  "signedAt": 1792641600,
  "signature": "q8LxS1v0m2Yc3Gz7Jt5Wd9Rk4Hn6Bp2Ue8Af0Ci3Xo5Ls7Nq1Mv4Tz6Ry9Pw2Eb8Kj3Dh5Fg7Ua0Sc4Lz1Ow=="
}

kv deactivate '{"licenseKey":"DSP-7KQ2-M9XW-4HNP-R3TA","deviceId":"3f2a9c0d8e7b6a5f4e3d2c1b0a998877"}'

{
  "ok": true,
  "data": {
    "action": "deactivate",
    "activated": false,
    "activatedAt": 1792641600,
    "activeDevices": 1,
    "appId": "app_7kq2m9xw4hnp",
    "deviceId": "3f2a9c0d8e7b6a5f4e3d2c1b0a998877",
    "expiresAt": 1824177600,
    "keyFingerprint": "9b74c9897bac770ffc029102a200c5de1f4f7b5c8c2e1d6f0a3b4c5d6e7f8091",
    "maxDevices": 2,
    "status": "active",
    "validUntil": null
  },
  "signedAt": 1792641600,
  "signature": "q8LxS1v0m2Yc3Gz7Jt5Wd9Rk4Hn6Bp2Ue8Af0Ci3Xo5Ls7Nq1Mv4Tz6Ry9Pw2Eb8Kj3Dh5Fg7Ua0Sc4Lz1Ow=="
}

curl https://shop.example.com/api/v1/public-key

{
  "ok": true,
  "data": {
    "algorithm": "Ed25519",
    "pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA…\n-----END PUBLIC KEY-----",
    "base64": "MCowBQYDK2VwAyEA…",
    "raw": "EVMGbdm+3WlkPPF/…",
    "fingerprint": "3e61a6ac40704b0b…"
  }
}

{"data":{"action":"verify","activated":true,"activatedAt":1792641600,"activeDevices":2,"appId":"app_7kq2m9xw4hnp","deviceId":"3f2a9c0d8e7b6a5f4e3d2c1b0a998877","expiresAt":1824177600,"keyFingerprint":"9b74c989…","maxDevices":2,"status":"active","validUntil":1792900800},"nonce":"9f86d081884c7d659a2feaa0c55ad015","signedAt":1792641600}

import { createPublicKey, verify } from "node:crypto";

const publicKey = createPublicKey(PUBLIC_KEY_PEM); // 随客户端发布，不要运行时下载

function canonicalJson(v: unknown): string {
  if (v === null || typeof v !== "object") return JSON.stringify(v);
  if (Array.isArray(v)) return `[${v.map(canonicalJson).join(",")}]`;
  const o = v as Record<string, unknown>;
  return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
}

const json = await res.json();
// nonce 用你这次请求自己生成的那个，而不是从响应里读
const payload = canonicalJson({ data: json.data, nonce, signedAt: json.signedAt });
const ok = verify(null, Buffer.from(payload), publicKey, Buffer.from(json.signature, "base64"));
if (!ok || json.data.deviceId !== deviceId) throw new Error("响应校验失败");

import { getDeviceId } from "./keyvault";

// 读取系统机器 ID（macOS IOPlatformUUID / Windows MachineGuid / Linux machine-id），
// 与 appId 一起做 SHA-256：同一台机器在不同软件里得到不同的 ID
const deviceId = getDeviceId("app_7kq2m9xw4hnp");