Response Signature v2

Overview

Response objects from License API endpoints contain an HTTP header LicenseSignature which is an HMAC-SHA256 signature used to verify the integrity and authenticity of the response. This is not the same as the license_signature in certain response objects (see Response Signature for that property).

The LicenseSignature header signs the entire response object using our private key, which enables you to use our public key to verify the signature.

Verifying Response Signature v2

You can use the server's public key to verify the LicenseSignature header. By validating the signature, you ensure the response originates from LicenseSpring's trusted servers.

Download the server public key from the link below to implement signature verification using the example provided:

Download prod.pub

Code Sample

verify-response-signature.js

import crypto from 'node:crypto'
import dayjs from 'dayjs'
import utc from 'dayjs/plugin/utc.js'

dayjs.extend(utc)

// Header and response received from our servers:
const responseLicenseSignatureHeader = '...';
const responseBody = {
  // ... response object from LicenseSpring's server ...
};

/* 
  NOTE: specifically for the Activate License Offline endpoint, existing
  signatures in the response body need to be removed before calculating
  the v2 signature, like this:
  
  delete responseBody.license_signature;
  delete responseBody.license_signature_v2;
*/

const verifier = crypto.createVerify('RSA-SHA256');
verifier.update(JSON.stringify(response));
const result = verifier.verify(publicKey, responseLicenseSignatureHeader, 'base64');

console.log(result); // will be "true" if signature is valid