Rust SDK

Drop-in source files for Rust — copy them into your project. Nothing to install from a package registry.

use license_client::LicenseClient;

let client = LicenseClient::new(
    "https://license.foliox.sbs",
    "YOUR_PRODUCT_ID",                       // shown on the product's page in your dashboard
    "PASTE_PUBLIC_KEY_FROM_THE_DOCS",        // public - not a secret
)?;                                          // unsafe or malformed configuration is an Err here

let result = client.check(license_key);
if result.valid {
    println!("licensed, status: {:?}, expires: {:?}", result.status, result.expires_at);
} else {
    println!("not licensed: {:?}", result.reason);
}

Copy src/lib.rs (and the dependencies from Cargo.toml) into your own crate, or run cargo run --example basic -- <key> here.

Tuning: LicenseClient::with_options(base_url, product, public_key, ClientOptions { timeout, max_retries, backoff_base, backoff_cap, total_deadline, max_response_age, cache_path, hwid, allow_insecure_loopback, ..Default::default() }). Also verify (never activates), clear_cache, is_valid_key_format, compute_hwid.

What it does for you

• HTTPS only (plain http:// is refused except for localhost while developing); certificates always verified, TLS 1.2+, redirects never followed.
• Nothing is believed before its Ed25519 signature is checked, then the product it names and its age (max response age, default 15 minutes) so an old captured answer can't be replayed.
• Safe retries: network errors, timeouts, HTTP 429 and 5xx are retried with exponential backoff + jitter inside a hard deadline (default 20 s). A definite answer (revoked, expired, wrong device) is never retried or softened.
• Offline grace from the last valid signed answer (72 h, never past the key's own expiry), bound to this device, product and key; the raw key is never stored; a definite "no" deletes it; a clock set back is detected.
• check() never raises/panics for runtime conditions - it returns a result. Bad configuration is reported when the client is created.

Offline grace is a resilience feature, not a security boundary. See the SDKs & API wrapper page in your server's docs for the full list, what no client library can do, and upgrade notes from v1.