key/check

Validates a license key against a hardware ID and returns an HMAC-signed response.

Request

POST /api/v1/key/check Content-Type: application/json. Authentication is the request signature itself — see Authentication. Body:

Field	Type	Required	Notes
`project_id`	string	yes	Your public project ID.
`key`	string	yes	The license key to validate.
`hwid`	string	yes	Hardware ID from the client. Passthrough: Vampauth only compares.
`nonce`	string	yes	Client-generated random value, at most 128 chars. Fresh per call.
`signature`	string	yes	`HMAC_SHA1(auth_secret, nonce\|key\|hwid)`, lowercase hex (40 chars).
`executor`	string	no	Plain executor label, e.g. `"Delta"`. Shown in your analytics. Max 64 chars. Unsigned — treat as cosmetic.

{
  "project_id": "2Q9V222NTI2WJ45N",
  "key": "A13A-6D58-A93C-6AC7",
  "hwid": "delta-live-test-hwid",
  "nonce": "docs-example-nonce-0001",
  "signature": "ccc74a4b547a61c1e2040faae035e22058c87ec1",
  "executor": "Delta"
}

Success response

HTTP 200:

{
  "status": "valid",
  "key": "A13A-6D58-A93C-6AC7",
  "hwid_bound": false,
  "expires_at": "2026-12-31T23:59:59.000Z",
  "created_at": "2026-09-01T12:00:00.000Z",
  "nonce_echo": "docs-example-nonce-0001",
  "signature": "7138f26fdda7f37abf453c67fe5675daca003490",
  "project_id": "61b4a242-e6b3-4765-aefb-23904d92d984"
}

Field	Type	Notes
`status`	string	`valid`
`key`	string	The validated key.
`hwid_bound`	boolean	Whether this key is bound to the provided `hwid`.
`expires_at`	string or null	Key expiry, ISO 8601. `null` when the key never expires.
`created_at`	string	When the key was issued.
`nonce_echo`	string	Echo of your `nonce`. Must match what you sent.
`signature`	string	`HMAC_SHA1(auth_secret, nonce_echo\|status\|expiresAtUnix\|project_id)`, lowercase hex. Verify it — see Signature verification.
`project_id`	string	The project’s internal UUID (not the public ID you sent).

Every successful call updates the key’s usage stats: execution count, first_used, last_used, and the executor breakdown shown in your dashboard analytics.

Errors

Error body is { "error": "...", "message": "..." }.

HTTP	`error`	Meaning
400	`INVALID_REQUEST`	Missing/malformed body field, or nonce over 128 chars.
401	`BAD_SIGNATURE`	Request `signature` doesn’t match — wrong auth secret or tampered fields.
401	`UNAUTHORIZED`	`project_id` doesn’t exist (or the key belongs to another project).
403	`KEY_BANNED`	Key is banned or revoked.
403	`FINGERPRINT_MISMATCH`	Key is bound to different hardware and isn’t FFA.
404	`KEY_NOT_FOUND`	No such key on any project.
410	`KEY_EXPIRED`	Key has expired.
429	`RATE_LIMITED`	Over 120 req / 60s per IP. Retry after `retry_after` seconds.

Empty or malformed JSON also returns 400 INVALID_REQUEST. There is deliberately no endpoint to reset HWIDs from a script — resets happen in the dashboard or the public flow page only.

Getting Started

Platform

REST API

Guides

key/check

key/check

Request

Success response

Errors

​key/check

​Request

​Success response

​Errors

key/check

Request

Success response

Errors