Offline Licensing

Offline Activation

Offline activation lets customers activate a license key on a machine that has no internet access. Instead of calling the public API, the customer presents a signed offline token that was generated for their specific device by a Company Admin.

How it works

1. Customer generates their hardware fingerprint (HWID) and sends it to you via email / support portal.
2. Admin opens the license in PermitCore → scrolls to Offline Activation Tokens → clicks Generate Token.
3. Admin enters the Device ID, optional device name, and how long the token should be valid (1–365 days).
4. A signed token is shown once — admin copies and sends it to the customer.
5. Customer's application calls ActivateOffline(token) in your SDK. The SDK verifies the ECDSA signature, expiry, and device binding, then stores the token locally.
6. On every subsequent launch, the SDK verifies the cached token offline — no internet needed.

Step-by-step in the Admin Panel

The token and the public key come from two different places in the admin panel — do this in order, since the token is worthless to a customer without your real public key to verify it against.

Token format

Tokens have the format pc_offline_v1.<payload>.<signature>:

What the SDK does

1. Split on ., check prefix is pc_offline_v1
2. Fetch (or load cached) tenant public key from /api/v1/{slug}/public-key
3. Verify ECDSA signature — reject if invalid or tampered
4. Check expiresAt > now — reject if expired
5. Check deviceId matches local hardware fingerprint — reject if different machine
6. Store token on disk — verified offline on every future launch

var client = new PermitCoreClient("https://your-domain.com");
var publicKey = /* fetched once from GET /api/v1/{slug}/public-key, then cached */;

// Offline activate (customer sent you the token) — persists to local disk
var result = PermitCoreClient.ActivateOffline(offlineToken, publicKey, hwid);

// On every subsequent launch — no internet needed
var result = PermitCoreClient.ValidateOffline(hwid);

# pip install cryptography  (lazy-imported — base client stays dependency-free)
result = PermitCoreClient.activate_offline(offline_token, public_key, hwid)

# On every subsequent launch — no internet needed
result = PermitCoreClient.validate_offline(hwid)

const result = client.activateOffline(offlineToken, publicKey, hwid);

// On every subsequent launch — no internet needed
const result = client.validateOffline(hwid);

$result = $client->activateOffline($offlineToken, $publicKey, $hwid);

// On every subsequent launch — no internet needed
$result = $client->validateOffline($hwid);

OfflineTokenResult result = client.activateOffline(offlineToken, publicKey, hwid);

// On every subsequent launch — no internet needed
OfflineTokenResult result = client.validateOffline(hwid);

auto result = client.activate_offline(offline_token, public_key, hwid);

// On every subsequent launch — no internet needed
auto result = permitcore::PermitClient::validate_offline(hwid);

Revoking a token

To revoke an offline token, go to the license detail page → Offline Activation Tokens → click the ban icon next to the token. The token is immediately marked as revoked in the database.

Revoking is soft enforcement: the SDK can optionally call POST /api/v1/offline/verify to check revocation status when online. Strictly offline deployments won't see revocations until the token naturally expires. Use short expiresInDays values (e.g. 30–90 days) for tighter control.

Optional server-side verification

When the customer's machine has internet access, your SDK can also call the server to check for revocation:

{
  "token": "pc_offline_v1.eyJ2ZXJzaW9uIjoxLCJ..."
}

{
  "isValid":     true,
  "tokenId":     "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "productName": "Acme Video Editor Pro",
  "deviceId":    "a3f8d2b1c9e4...",
  "expiresAt":   "2026-08-29T00:00:00Z",
  "message":     "Token valid."
}

Security properties