Java licensing API

Validate a licence key

One POST to /apps/{appId}/licenses/authenticate. Java 11+. No dependencies.

import java.net.URI;
import java.net.http.*;

var appId = System.getenv("EVORA_APP_ID");
var body = """
    {"licenseKey": "%s"}
    """.formatted(licenseKey);

var request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.evora.lol/api/developer-api/apps/" + appId + "/licenses/authenticate"))
    .header("Authorization", "Bearer " + System.getenv("EVORA_API_KEY"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(body))
    .build();

var response = HttpClient.newHttpClient()
    .send(request, HttpResponse.BodyHandlers.ofString());

// response.body() is JSON: { "authenticated": true, "subscription": { ... } }

What you get back

• authenticated — whether the key is valid and usable right now.
• subscription.level and subscription.name — the tier you configured.
• subscription.active — false when expired or paused. Use this, not the raw expiry.
• subscription.hwid — the bound device, when HWID locking is on.

Keep the key server-side

The API key is a server credential. The safe shape is always: browser → your server → Evorion. Your backend holds the key, validates the licence, then issues your own session.

• Never ship ag_sk_ keys to a client of any kind.
• Scope each key to the minimum it needs, and to one application where you can.
• Rotate from the dashboard; keys are shown once on creation.

Native apps want the C++ SDK

If you are shipping a Windows binary to end users, REST alone leaves the client unprotected. The C++ SDK adds encrypted bodies, device-bound credentials and runtime protection that a dashboard toggle can change mid-session.

• SDK documentation
• Full REST reference