Go licensing API

Validate a licence key

One POST to /apps/{appId}/licenses/authenticate. Go 1.21+. Standard library only.

package licence

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
	"time"
)

type Result struct {
	Authenticated bool `json:"authenticated"`
	Subscription  *struct {
		Level  int    `json:"level"`
		Name   string `json:"name"`
		Active bool   `json:"active"`
	} `json:"subscription"`
}

func Verify(key string) (*Result, error) {
	body, _ := json.Marshal(map[string]string{"licenseKey": key})
	url := fmt.Sprintf("https://api.evora.lol/api/developer-api/apps/%s/licenses/authenticate", os.Getenv("EVORA_APP_ID"))

	req, _ := http.NewRequest("POST", url, bytes.NewReader(body))
	req.Header.Set("Authorization", "Bearer "+os.Getenv("EVORA_API_KEY"))
	req.Header.Set("Content-Type", "application/json")

	res, err := (&http.Client{Timeout: 10 * time.Second}).Do(req)
	if err != nil {
		return nil, err
	}
	defer res.Body.Close()

	var out Result
	return &out, json.NewDecoder(res.Body).Decode(&out)
}

What you get back

• authenticated — whether the key is valid and usable right now.
• subscription.level and subscription.name — the tier you configured.
• subscription.active — false when expired or paused. Use this, not the raw expiry.
• subscription.hwid — the bound device, when HWID locking is on.

Keep the key server-side

The API key is a server credential. The safe shape is always: browser → your server → Evorion. Your backend holds the key, validates the licence, then issues your own session.

• Never ship ag_sk_ keys to a client of any kind.
• Scope each key to the minimum it needs, and to one application where you can.
• Rotate from the dashboard; keys are shown once on creation.

Native apps want the C++ SDK

If you are shipping a Windows binary to end users, REST alone leaves the client unprotected. The C++ SDK adds encrypted bodies, device-bound credentials and runtime protection that a dashboard toggle can change mid-session.

• SDK documentation
• Full REST reference