key/check

Validates a license key for a given hardware ID and returns an Ed25519-signed response.

Request

POST /api/v1/key/check Headers:

Header	Value
`X-Project-Key`	`pk-...` (required)
`Content-Type`	`application/json`

Body:

Field	Type	Required	Notes
`key`	string	yes	The license key to validate.
`hwid`	string	yes	Hardware ID from the client. Passthrough: Vampauth compares only.
`nonce`	string	yes	Client-generated random value, at most 128 chars. Fresh per call. The server only echoes and signs it — see Nonce.

{
  "key": "DP3P-YDMA-NJDI-HJJC",
  "hwid": "my-hwid",
  "nonce": "abc123"
}

Success response

HTTP 200

{
  "status": "valid",
  "key": "DP3P-YDMA-NJDI-HJJC",
  "hwid_bound": true,
  "expires_at": "2026-08-15T14:56:04.493Z",
  "nonce_echo": "abc123",
  "signature": "VKJ9UnMY...",
  "project_id": "df7c4445-..."
}

Field	Type	Notes
`status`	string	`valid`
`key`	string	The validated key.
`hwid_bound`	boolean	Whether this key is bound to the provided `hwid`.
`expires_at`	string or null	Key expiry, ISO 8601. Null when it never expires.
`nonce_echo`	string	Echo of the request `nonce`.
`signature`	string	Base64 Ed25519 signature. See Signature verification.
`project_id`	string	The project this key belongs to.

Every successful call increments the key’s usage stats (executions, last_used) and persists them.

Errors

HTTP	`error`	Meaning
400	`INVALID_REQUEST`	Missing or malformed body field, or nonce too long.
401	`UNAUTHORIZED`	Missing or invalid `X-Project-Key`.
403	`KEY_BANNED`	Key revoked or banned.
403	`FINGERPRINT_MISMATCH`	Key is bound to different hardware.
404	`KEY_NOT_FOUND`	No such key.
410	`KEY_EXPIRED`	Key has expired.
429	`RATE_LIMITED`	Too many requests. Retry after `retry_after`.

Error body:

{
  "error": "FINGERPRINT_MISMATCH",
  "message": "This key is locked to different hardware."
}

Getting Started

Platform

REST API

Guides

key/check

key/check

Request

Success response

Errors

​key/check

​Request

​Success response

​Errors

key/check

Request

Success response

Errors