FAQ

Questions that come up most often when adopting and integrating Signox. See the Overview for the domain model and design principles, and the Quickstart for the actual integration flow.

Is this the same as an e-signature service?

No. E-signatures are about people signing documents, while Signox issues, validates, and manages software licenses. They deal with entirely different things.

How safe is it against piracy?

Honestly, no licensing is 100% foolproof (client-side validation can be bypassed). Signox uses unforgeable Ed25519 signatures to make piracy far harder and more expensive, nudging people toward an honest purchase.

Can I use it offline in air-gapped networks with no internet?

Yes. Issue and distribute .lic files signed with Ed25519, and the client validates them locally using only the public key, with no network. You can sell as-is to air-gapped customers in finance, defense, manufacturing, and more. See Offline Activation for the full flow.

How is security guaranteed?

Every license is signed with an Ed25519 asymmetric key, and the private key is kept only on the server. Only the public key is distributed to clients, so signatures can’t be forged, and every issuance and revocation is recorded in an audit log.

How do I integrate? Do I need a separate API token?

You integrate via the Signox SDK embedded in your app. You only call SignoxClient’s activate() (one-time activation), validate() (checked on startup), and deactivate() (release when moving devices).

There is no separate API token. The sole credential is the license key (licenseKey) — because a secret token shipped inside distributed software can be extracted. See the Node.js SDK and Quickstart for integration examples.

What does the license key look like?

Six groups of six characters, 36 characters total. For example:

S7K4M2-9I3XQ8-4TG5BN-A2PN6C-5RH8O3-K9D2VX

The brand SIGNOX is woven diagonally through the groups, which we use for format validation (catching typos and first-pass forgeries). But actual tamper protection comes from the Ed25519 signature, not the format — validity is never judged by the format alone.

How many devices can one license activate?

Every license is node-locked. A license key alone does not authenticate; it must be paired with the device identifier (hwid) the SDK generates automatically. The number of concurrent seats is governed by the policy’s maxDevices, which always applies (there is no per-license override). See Device Identification for how devices are identified.

Do I still need an internet connection after activation?

No. Once activated online, the SDK caches the signed license state locally, so it works afterward without a network.

Branch your app’s behavior on the status code returned by validate():

• VALID · IN_GRACE_PERIOD → valid = true (proceed normally; prompt for renewal during the grace period)
• EXPIRED · SUSPENDED · REVOKED, etc. → valid = false (handle as an authentication failure)

State transitions and the full lifecycle are covered in Online Activation.

Which languages and platforms are supported?

The SDK for Node.js (server, CLI, Electron) comes first, with Java and C# SDKs to follow. The SDK handles device identification, signature verification, offline validation, and local caching. If you need a language or platform the SDK does not cover yet, please reach out.

What license types can I issue?

You set the license type in the policy — perpetual (perpetual), timed (timed), or trial (trial). Device limits, grace periods, and feature values are also managed per policy. See the Overview for the underlying concepts.