Why do I get hwid_mismatch?

The key was activated on a different computer. The customer can request a device reset, and you approve it in your dashboard.

Why do I get not_activated from verify?

verify never activates. Call activate on first run (the SDK does this for you), then verify on later runs.

Can one license key be used by many people?

Yes: create it as a public key (the Public key switch when you generate keys, or keyType "public" in the automation API). A public key is never bound to a device, so any number of people can use it at the same time. Revoke it to stop all of them at once.

How long does the offline cache last?

Every signed answer includes an offline_grace_until time 72 hours after it was issued. The SDK keeps running from the last valid answer until then.

FAQ & troubleshooting

The reasons your software might refuse a key, and how to fix each one.

Reason codes

reason	What it means	What to do
`hwid_mismatch`	The key is bound to a different computer (device-locked keys only).	The customer requests a device reset on the license check page; you approve it in the dashboard. If the key is meant to be shared, give out a public key instead.
`not_activated`	You called verify for a key that was never activated (or, for a multi-device key, not yet on this device).	Call activate first (the SDK does it automatically).
`device_limit`	The key is already used on as many devices as it allows.	Reset its devices, raise its device count (paid plans: up to 3, 5 or 15), or upgrade for a bigger public-key limit.
`expired`	The key’s end date has passed.	Extend the key in the dashboard — it works again immediately, on the same computer.
`revoked`	You (or the seller) revoked it.	Restore it from the dashboard if that was a mistake.
`suspended`	The account that issued the key is suspended.	Contact the service operator.
`not_found`	No such key for that product slug.	Check the slug and that the customer pasted the whole key.
`malformed_key`	The key fails its checksum — usually a typo.	Ask the customer to re-enter it; dashes are optional.
`blocked`	The device or address was banned.	Only the service operator can lift this.

One key for many users

Generate the key with the Public key switch on (or "keyType": "public" in the automation API). A public key never binds to a device: everyone who has it can activate and use it, on as many computers as they like, at the same time. Expiry and revocation still work — revoking it stops every copy at once. Use device-locked keys for anything you sell per customer, because anyone who sees a public key can use it. See key types.

My app fails when the internet is down

The SDK falls back to its cached, signed “valid” answer for up to 72 hours after the last successful check. If the customer has never completed a check on that machine, there is nothing to fall back on and the app must be online for the first activation.

I get 429 responses

The API rate-limits activation and verification per address and per key (public keys skip the per-key limit, since many people share them). A shipped app should check on start-up (and maybe once a day), not in a tight loop. Reset requests and customer lookups have their own, stricter limits.

Signature verification fails

Make sure you use the public key from /api/v1/public-key of this service (it never changes unless we announce it).
Verify the exact JSON payload the server sent, serialised with sorted keys — see the security model.
Check the computer’s clock: answers are time-stamped, and the offline grace is computed from the server’s time.

Can I choose my own product ID?

No — the service generates it (a random, unique value) so nobody can guess or squat on yours, and it never changes once created. Copy it from the product’s page into your app.

Customers didn’t get their e-mail

Check the address on the key, and ask them to look in spam.
Customer e-mails can be switched off in Settings → Profile, and each plan has a monthly allowance (see Accounts & plans).
You can resend from the key’s detail panel with E-mail key to customer.