Node.js licensing API

Validate a licence key

One POST to /apps/{appId}/licenses/authenticate. Node 18+ (global fetch). No dependencies.

const APP_ID = process.env.EVORA_APP_ID;

export async function verifyLicence(licenseKey) {
  const res = await fetch(
    `https://api.evora.lol/api/developer-api/apps/${APP_ID}/licenses/authenticate`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.EVORA_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ licenseKey }),
    },
  );

  if (!res.ok) return { ok: false, status: res.status };
  const data = await res.json();
  return { ok: data.authenticated === true, subscription: data.subscription };
}

// Call this from your server only. A key in client-side JS is a public key.

What you get back

• authenticated — whether the key is valid and usable right now.
• subscription.level and subscription.name — the tier you configured.
• subscription.active — false when expired or paused. Use this, not the raw expiry.
• subscription.hwid — the bound device, when HWID locking is on.

Keep the key server-side

The API key is a server credential. The safe shape is always: browser → your server → Evorion. Your backend holds the key, validates the licence, then issues your own session.

• Never ship ag_sk_ keys to a client of any kind.
• Scope each key to the minimum it needs, and to one application where you can.
• Rotate from the dashboard; keys are shown once on creation.

Native apps want the C++ SDK

If you are shipping a Windows binary to end users, REST alone leaves the client unprotected. The C++ SDK adds encrypted bodies, device-bound credentials and runtime protection that a dashboard toggle can change mid-session.

• SDK documentation
• Full REST reference