CMSX Documentation

Protect your software with cryptographic license validation in minutes. No SDKs required — just simple REST API calls with Ed25519 signed responses.

Quick Start

Follow these five steps to add license validation to your application.

Authentication

All API requests require an API key sent via the X-Api-Key header.

curl -H "X-Api-Key: xk_your_api_key" https://api.cmsx.dev/health

API Reference

All endpoints use the following base URL:

https://api.cmsx.dev

Validate a license key and optionally activate a machine. If the machine is new and the license has available activations, it will be activated automatically.

Request Headers

X-Api-Key: xk_your_api_key
Content-Type: application/json

Request Body

{
  "license_key": "XCR-xxxx-xxxx-xxxx",
  "machine_id": "unique-device-fingerprint",
  "app_version": "1.0.0"
}

Response — 200 OK

{
  "valid": true,
  "license_id": "6c9885fc-1478-45dc-8115-84a3e25920ce",
  "product_id": "e51cd7a3-78c9-4f8c-b95f-7b48068fb274",
  "status": "active",
  "config": {},
  "signature": "648a28cfd782ef380afda0a55be2fdc2...",
  "validated_at": "2026-02-27T01:41:10.044Z"
}

Deactivate a machine from a license, freeing up an activation slot.

Request Body

{
  "license_key": "XCR-xxxx-xxxx-xxxx",
  "machine_id": "unique-device-fingerprint"
}

Response — 200 OK

{
  "success": true,
  "message": "Machine deactivated successfully"
}

Core Concepts

License Keys

Licenses follow the format XCR-xxxx-xxxx-xxxx. Each license is bound to a single product and can be configured with:

• Maximum number of machine activations
• Expiration date
• Custom configuration metadata (feature flags, tiers, etc.)

Ed25519 Signatures

Every validation response includes a cryptographic signature generated with your product's Ed25519 private key. Use the corresponding public key (available in your dashboard) to verify the response was not tampered with.

This enables offline validation — cache the signed response and verify it locally without hitting the API.

Machine Fingerprinting

Bind licenses to specific devices using unique machine identifiers. The machine_id field in the validation request should be a stable device fingerprint. This lets you control how many devices can use a single license simultaneously.

Kill Switch

Instantly revoke all active licenses for a product with a single toggle in the dashboard. When activated, every validation request returns status: "killed" and valid: false.

Offline Validation

Cache the validation response locally and use the Ed25519 signature to verify authenticity without network access. This ensures your application works even when the user has no internet connectivity.

License Statuses

Error Codes

Rate Limits