Ruby licensing API

Validate a licence key

One POST to /apps/{appId}/licenses/authenticate. Ruby 3.0+. Standard library only.

require "net/http"
require "json"

APP_ID = ENV.fetch("EVORA_APP_ID")

def verify_licence(license_key)
  uri = URI("https://api.evora.lol/api/developer-api/apps/#{APP_ID}/licenses/authenticate")

  req = Net::HTTP::Post.new(uri)
  req["Authorization"] = "Bearer #{ENV.fetch('EVORA_API_KEY')}"
  req["Content-Type"]  = "application/json"
  req.body = { licenseKey: license_key }.to_json

  res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
  data = JSON.parse(res.body)

  { ok: data["authenticated"] == true, subscription: data["subscription"] }
end

What you get back

• authenticated — whether the key is valid and usable right now.
• subscription.level and subscription.name — the tier you configured.
• subscription.active — false when expired or paused. Use this, not the raw expiry.
• subscription.hwid — the bound device, when HWID locking is on.

Keep the key server-side

The API key is a server credential. The safe shape is always: browser → your server → Evorion. Your backend holds the key, validates the licence, then issues your own session.

• Never ship ag_sk_ keys to a client of any kind.
• Scope each key to the minimum it needs, and to one application where you can.
• Rotate from the dashboard; keys are shown once on creation.

Native apps want the C++ SDK

If you are shipping a Windows binary to end users, REST alone leaves the client unprotected. The C++ SDK adds encrypted bodies, device-bound credentials and runtime protection that a dashboard toggle can change mid-session.

• SDK documentation
• Full REST reference