Licence verification returns a signed token that stays valid for a grace period you set. That period exists because the network between your buyer's server and ours will fail, and when it does, their site must keep working.
Why it matters more than it sounds
Plenty of buyers run on hosts that block outbound HTTP entirely. Others sit behind corporate firewalls, or run in environments with no internet at all. If your script treats an unreachable licence server as an invalid licence, it does not work for those buyers, and the reviews will say so.
Verify offline first
The token is signed with our private key and verified against the public key bundled in the SDK. That check needs no network at all. Read the cached token, verify the signature, check it has not expired, and only call out when it has.
Choose a grace period that fits the buyer
- Seven days suits most web software
- Thirty days is reasonable for anything that might run somewhere air-gapped
- Under a day is almost always too aggressive and will generate support tickets
Degrade, do not stop
If the grace period does lapse, think hard before switching the whole product off. A banner in the admin area saying the licence could not be checked gets the owner's attention without taking down their business. Reserve hard failure for a licence that came back explicitly revoked.
Make the state visible
Show, somewhere in an admin screen, when the licence was last verified and when it will be checked again. When something does go wrong, that one line turns a support ticket into a self-diagnosis.
