keymint 2.6.0__tar.gz → 2.7.0__tar.gz

{keymint-2.6.0/keymint.egg-info → keymint-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keymint
-Version: 2.6.0
+Version: 2.7.0
 Summary: License key validation, activation, and management for Python. Supports node-locking, offline licensing, and hardware fingerprinting.
 Home-page: https://github.com/keymint-dev/keymint-python
 Author: KeyMint
@@ -24,6 +24,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.32.4
+Requires-Dist: cryptography>=41
 Provides-Extra: dev
 Requires-Dist: pytest>=6.0; extra == "dev"
 Requires-Dist: pytest-cov; extra == "dev"
@@ -51,6 +52,7 @@ A professional, production-ready SDK for integrating with the Keymint API in Pyt
 - **Type hints**: Full type hint support for better IDE integration and code safety.
 - **Comprehensive**: Complete API coverage for all Keymint endpoints.
 - **Consistent error handling**: All API errors are returned as structured objects or exceptions.
+- **Offline licenses**: Verify signed `.lic` files locally with `verify_offline_license`.
 - **Machine Identity**: Built-in utilities for hardware fingerprinting and stable installation IDs.
 
 ## Installation
@@ -111,6 +113,81 @@ else:
 
 Store the last `expirationDate` you received. An expired license fails activation with the same generic invalid-key error as a wrong key, so the stored date is how your app can tell the user the license expired on that date instead of calling the key invalid.
 
+## Offline Licenses
+
+An offline license is a `.lic` file holding a token signed with your organization's Ed25519 key. Your app verifies it locally with `verify_offline_license`, with no network call.
+
+1. **Get the `.lic` file** from the dashboard's Offline License dialog, or with `sign_key` from your own backend (it needs an admin API key, so never call it from the shipped app). The `hostId` you sign for becomes the license's machine code, so use the ID the customer's machine reports, e.g. `identity.get_or_create_installation_id()`.
+
+   ```python
+   # On your server, with host_id sent by the customer's machine:
+   result = sdk.sign_key({'productId': product_id, 'licenseKey': license_key, 'hostId': host_id})
+   lic = result['file']  # the .lic contents; deliver this to the customer
+   ```
+
+2. **Bundle your public key** with the app: copy the PEM from **Developer → Public Keys** in the dashboard. It is a public key, so shipping it is safe.
+
+3. **Verify** with the product ID and this machine's code:
+
+   ```python
+   from keymint import OfflineLicenseError, identity, verify_offline_license
+
+   PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----
+   MCowBQYDK2VwAyEA...
+   -----END PUBLIC KEY-----
+   """
+
+   with open('license.lic', encoding='utf-8') as f:
+       lic = f.read()
+
+   try:
+       offline = verify_offline_license(
+           lic,
+           public_keys=[PUBLIC_KEY],
+           product_id='prod_...',  # this app's product ID
+           machine_code=identity.get_or_create_installation_id(),
+       )
+       print(f'Licensed until {offline.expires_at:%Y-%m-%d}')
+   except OfflineLicenseError as err:
+       if err.code == 'expired':
+           ...  # ask the customer to renew or reconnect
+       elif err.code in ('wrong_product', 'wrong_machine'):
+           ...  # a real license, but not for this product or this machine
+       else:
+           ...  # malformed, unsupported_algorithm, unknown_key, bad_signature, wrong_type: not a valid license
+   ```
+
+`verify_offline_license` accepts the `.lic` file contents or the bare token and returns an `OfflineLicense` with `license_key`, `product_id`, `machine_code`, `key_id`, `issued_at` (or `None`) and `expires_at` (timezone-aware UTC datetimes). On failure it raises `OfflineLicenseError`; `err.code` is one of:
+
+| Code | Meaning |
+|---|---|
+| `malformed` | Not a license file or token, or required claims (`exp`, `sub`) are missing or invalid. |
+| `unsupported_algorithm` | The token is not signed with EdDSA (e.g. `none`, `HS256`). |
+| `unknown_key` | Signed by a key that isn't in `public_keys`. |
+| `bad_signature` | The signature doesn't match: the file was altered or forged. |
+| `wrong_type` | The token is not an offline license. |
+| `wrong_product` | The license is for a different product. |
+| `wrong_machine` | The license is for a different machine. |
+| `expired` | Past its expiry, plus `clock_skew` (default 60 seconds, max 3600). |
+
+Bad arguments (no public keys, a PEM that isn't an Ed25519 public key, an empty `product_id` or `machine_code`, `clock_skew` outside 0..3600, a naive `now`) raise `ValueError` or `TypeError`, not `OfflineLicenseError`.
+
+**`product_id` is required.** One signing key covers all of an organization's products, so without the product check a license for a cheap product would unlock an expensive one.
+
+**Clock rollback.** The SDK can't tell if the system clock was set back. To guard against it, store the latest time you have trusted (for example, after each successful run) and pass the later of the two as `now`. `now` must be timezone-aware:
+
+```python
+from datetime import datetime, timezone
+
+now = max(datetime.now(timezone.utc), last_trusted_time)
+offline = verify_offline_license(lic, public_keys=[PUBLIC_KEY], product_id=product_id,
+                                 machine_code=machine_code, now=now)
+```
+
+`public_keys` accepts several keys, so apps are ready for key rotation. An offline license stays valid until it expires; it can't be revoked before then.
+
+Offline verification uses the [`cryptography`](https://pypi.org/project/cryptography/) package, which `pip install keymint` installs (`cryptography>=41`).
+
 ## Machine Identity
 Keymint provides utilities to uniquely identify machines for node-locking:
 
@@ -130,6 +207,7 @@ Keymint provides utilities to uniquely identify machines for node-locking:
 | `update_key`     | Updates an existing license key.                |
 | `block_key`      | Blocks a license key.                           |
 | `unblock_key`    | Unblocks a previously blocked license key.      |
+| `delete_key`     | Permanently deletes a license key.              |
 | `sign_key`       | Signs a key for offline validation using an admin API key.|
 | `floating_checkout` | Checks out a floating license seat.          |
 | `floating_heartbeat`| Sends a heartbeat to keep a session alive.   |
@@ -145,7 +223,7 @@ Keymint provides utilities to uniquely identify machines for node-locking:
 | `get_customer_with_keys`| Gets a customer along with their license keys.   |
 | `update_customer`       | Updates customer information.                    |
 | `toggle_customer_status`| Toggles customer active status.                  |
-| `delete_customer`       | Permanently deletes a customer and their keys.   |
+| `delete_customer`       | Deletes a customer. Their license keys are kept; use `delete_key` to remove them. |
 
 ### Webhook Verification
 

{keymint-2.6.0 → keymint-2.7.0}/README.md

@@ -6,6 +6,7 @@ A professional, production-ready SDK for integrating with the Keymint API in Pyt
 - **Type hints**: Full type hint support for better IDE integration and code safety.
 - **Comprehensive**: Complete API coverage for all Keymint endpoints.
 - **Consistent error handling**: All API errors are returned as structured objects or exceptions.
+- **Offline licenses**: Verify signed `.lic` files locally with `verify_offline_license`.
 - **Machine Identity**: Built-in utilities for hardware fingerprinting and stable installation IDs.
 
 ## Installation
@@ -66,6 +67,81 @@ else:
 
 Store the last `expirationDate` you received. An expired license fails activation with the same generic invalid-key error as a wrong key, so the stored date is how your app can tell the user the license expired on that date instead of calling the key invalid.
 
+## Offline Licenses
+
+An offline license is a `.lic` file holding a token signed with your organization's Ed25519 key. Your app verifies it locally with `verify_offline_license`, with no network call.
+
+1. **Get the `.lic` file** from the dashboard's Offline License dialog, or with `sign_key` from your own backend (it needs an admin API key, so never call it from the shipped app). The `hostId` you sign for becomes the license's machine code, so use the ID the customer's machine reports, e.g. `identity.get_or_create_installation_id()`.
+
+   ```python
+   # On your server, with host_id sent by the customer's machine:
+   result = sdk.sign_key({'productId': product_id, 'licenseKey': license_key, 'hostId': host_id})
+   lic = result['file']  # the .lic contents; deliver this to the customer
+   ```
+
+2. **Bundle your public key** with the app: copy the PEM from **Developer → Public Keys** in the dashboard. It is a public key, so shipping it is safe.
+
+3. **Verify** with the product ID and this machine's code:
+
+   ```python
+   from keymint import OfflineLicenseError, identity, verify_offline_license
+
+   PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----
+   MCowBQYDK2VwAyEA...
+   -----END PUBLIC KEY-----
+   """
+
+   with open('license.lic', encoding='utf-8') as f:
+       lic = f.read()
+
+   try:
+       offline = verify_offline_license(
+           lic,
+           public_keys=[PUBLIC_KEY],
+           product_id='prod_...',  # this app's product ID
+           machine_code=identity.get_or_create_installation_id(),
+       )
+       print(f'Licensed until {offline.expires_at:%Y-%m-%d}')
+   except OfflineLicenseError as err:
+       if err.code == 'expired':
+           ...  # ask the customer to renew or reconnect
+       elif err.code in ('wrong_product', 'wrong_machine'):
+           ...  # a real license, but not for this product or this machine
+       else:
+           ...  # malformed, unsupported_algorithm, unknown_key, bad_signature, wrong_type: not a valid license
+   ```
+
+`verify_offline_license` accepts the `.lic` file contents or the bare token and returns an `OfflineLicense` with `license_key`, `product_id`, `machine_code`, `key_id`, `issued_at` (or `None`) and `expires_at` (timezone-aware UTC datetimes). On failure it raises `OfflineLicenseError`; `err.code` is one of:
+
+| Code | Meaning |
+|---|---|
+| `malformed` | Not a license file or token, or required claims (`exp`, `sub`) are missing or invalid. |
+| `unsupported_algorithm` | The token is not signed with EdDSA (e.g. `none`, `HS256`). |
+| `unknown_key` | Signed by a key that isn't in `public_keys`. |
+| `bad_signature` | The signature doesn't match: the file was altered or forged. |
+| `wrong_type` | The token is not an offline license. |
+| `wrong_product` | The license is for a different product. |
+| `wrong_machine` | The license is for a different machine. |
+| `expired` | Past its expiry, plus `clock_skew` (default 60 seconds, max 3600). |
+
+Bad arguments (no public keys, a PEM that isn't an Ed25519 public key, an empty `product_id` or `machine_code`, `clock_skew` outside 0..3600, a naive `now`) raise `ValueError` or `TypeError`, not `OfflineLicenseError`.
+
+**`product_id` is required.** One signing key covers all of an organization's products, so without the product check a license for a cheap product would unlock an expensive one.
+
+**Clock rollback.** The SDK can't tell if the system clock was set back. To guard against it, store the latest time you have trusted (for example, after each successful run) and pass the later of the two as `now`. `now` must be timezone-aware:
+
+```python
+from datetime import datetime, timezone
+
+now = max(datetime.now(timezone.utc), last_trusted_time)
+offline = verify_offline_license(lic, public_keys=[PUBLIC_KEY], product_id=product_id,
+                                 machine_code=machine_code, now=now)
+```
+
+`public_keys` accepts several keys, so apps are ready for key rotation. An offline license stays valid until it expires; it can't be revoked before then.
+
+Offline verification uses the [`cryptography`](https://pypi.org/project/cryptography/) package, which `pip install keymint` installs (`cryptography>=41`).
+
 ## Machine Identity
 Keymint provides utilities to uniquely identify machines for node-locking:
 
@@ -85,6 +161,7 @@ Keymint provides utilities to uniquely identify machines for node-locking:
 | `update_key`     | Updates an existing license key.                |
 | `block_key`      | Blocks a license key.                           |
 | `unblock_key`    | Unblocks a previously blocked license key.      |
+| `delete_key`     | Permanently deletes a license key.              |
 | `sign_key`       | Signs a key for offline validation using an admin API key.|
 | `floating_checkout` | Checks out a floating license seat.          |
 | `floating_heartbeat`| Sends a heartbeat to keep a session alive.   |
@@ -100,7 +177,7 @@ Keymint provides utilities to uniquely identify machines for node-locking:
 | `get_customer_with_keys`| Gets a customer along with their license keys.   |
 | `update_customer`       | Updates customer information.                    |
 | `toggle_customer_status`| Toggles customer active status.                  |
-| `delete_customer`       | Permanently deletes a customer and their keys.   |
+| `delete_customer`       | Deletes a customer. Their license keys are kept; use `delete_key` to remove them. |
 
 ### Webhook Verification
 

{keymint-2.6.0 → keymint-2.7.0}/keymint/__init__.py

@@ -1,9 +1,23 @@
 import requests
 
 from ._version import __version__
+from .offline import (
+    OfflineLicense,
+    OfflineLicenseError,
+    OfflineLicenseErrorCode,
+    verify_offline_license,
+)
 from .types import *
 
-__all__ = ['KeyMint', 'KeyMintApiError', '__version__']
+__all__ = [
+    'KeyMint',
+    'KeyMintApiError',
+    'OfflineLicense',
+    'OfflineLicenseError',
+    'OfflineLicenseErrorCode',
+    '__version__',
+    'verify_offline_license',
+]
 
 class KeyMint:
     def __init__(self, api_key: str, base_url: str = "https://api.keymint.dev"):
@@ -17,7 +31,8 @@ class KeyMint:
             'Content-Type': 'application/json'
         }
 
-    def _handle_request(self, method: str, endpoint: str, params: dict | None = None, query_params: dict | None = None, idempotency_key: str | None = None, extra_headers: dict | None = None):
+    def _handle_request(self, method: str, endpoint: str, params: dict | None = None, query_params: dict | None = None, idempotency_key: str | None = None, extra_headers: dict | None = None, delete_body: dict | None = None):
+        # DELETE sends a JSON body only when delete_body is given (delete_key).
         url = f'{self.base_url}{endpoint}'
         headers = self.headers.copy()
         if idempotency_key:
@@ -35,7 +50,10 @@ class KeyMint:
             elif method.upper() == 'PATCH':
                 response = requests.patch(url, json=params, params=query_params, headers=headers)
             elif method.upper() == 'DELETE':
-                response = requests.delete(url, params=query_params, headers=headers)
+                if delete_body is not None:
+                    response = requests.delete(url, json=delete_body, params=query_params, headers=headers)
+                else:
+                    response = requests.delete(url, params=query_params, headers=headers)
             else:
                 raise ValueError(f"Unsupported HTTP method: {method}")
             
@@ -156,6 +174,16 @@ class KeyMint:
         """
         return self._handle_request('POST', '/key/unblock', params, idempotency_key=idempotency_key)
 
+    def delete_key(self, params: DeleteKeyParams, idempotency_key: str | None = None) -> DeleteKeyResponse:
+        """
+        Permanently deletes a license key. Use block_key to stop a key reversibly.
+        :param params: Parameters for deleting the key.
+        :param idempotency_key: Optional unique identifier to ensure request idempotency.
+        :returns: The deletion confirmation.
+        """
+        body = {'productId': params['productId'], 'licenseKey': params['licenseKey']}
+        return self._handle_request('DELETE', '/key', idempotency_key=idempotency_key, delete_body=body)
+
     def update_key(self, params: 'UpdateKeyParams', idempotency_key: str | None = None) -> 'UpdateKeyResponse':
         """
         Updates an existing license key.
@@ -215,7 +243,7 @@ class KeyMint:
 
     def delete_customer(self, params: DeleteCustomerParams, idempotency_key: str | None = None) -> DeleteCustomerResponse:
         """
-        Permanently deletes a customer and all associated license keys.
+        Deletes a customer. Their license keys are kept; use delete_key to remove them.
         :param params: Parameters containing the customer ID.
         :param idempotency_key: Optional unique identifier to ensure request idempotency.
         :returns: The deletion confirmation.

{keymint-2.6.0 → keymint-2.7.0}/keymint/_version.py

@@ -1,6 +1,6 @@
 """KeyMint Python SDK version information."""
 
-__version__ = "2.6.0"
+__version__ = "2.7.0"
 __author__ = "KeyMint"
 __email__ = "cliff@keymint.dev"
 __url__ = "https://github.com/keymint-dev/keymint-python"

keymint-2.7.0/keymint/offline.py

@@ -0,0 +1,298 @@
+"""
+Offline license verification for the Keymint Python SDK.
+
+Verifies a signed offline license (the ``.lic`` file from the dashboard or
+``KeyMint.sign_key``) locally, with no network call. The license is an Ed25519
+JWT signed by your organization's key; you bundle the public key PEM from
+Developer -> Public Keys with your app.
+
+One signing key covers every product in an organization, so the product ID is
+a required argument: without it a license for one product would unlock another.
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import hashlib
+import json
+import math
+import re
+from collections.abc import Sequence
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+from typing import Any
+
+from cryptography.exceptions import InvalidSignature, UnsupportedAlgorithm
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from cryptography.hazmat.primitives.serialization import (
+    Encoding,
+    PublicFormat,
+    load_pem_public_key,
+)
+
+__all__ = [
+    'OfflineLicense',
+    'OfflineLicenseError',
+    'OfflineLicenseErrorCode',
+    'verify_offline_license',
+]
+
+DEFAULT_CLOCK_SKEW = 60
+MAX_CLOCK_SKEW = 3600
+
+# fullmatch, not match: '$' would also accept a trailing newline.
+_SEGMENT = re.compile(r'[A-Za-z0-9_-]*')
+# The characters JavaScript's String.prototype.trim removes, so every SDK
+# accepts the same inputs as the reference implementation.
+_WHITESPACE = (
+    ' \t\n\v\f\r         '
+    '    

  　'
+)
+_EPOCH = datetime(1970, 1, 1, tzinfo=timezone.utc)
+
+
+class OfflineLicenseErrorCode(str, Enum):
+    """Why an offline license was rejected. Compares equal to its string value."""
+
+    MALFORMED = 'malformed'
+    UNSUPPORTED_ALGORITHM = 'unsupported_algorithm'
+    UNKNOWN_KEY = 'unknown_key'
+    BAD_SIGNATURE = 'bad_signature'
+    WRONG_TYPE = 'wrong_type'
+    WRONG_PRODUCT = 'wrong_product'
+    WRONG_MACHINE = 'wrong_machine'
+    EXPIRED = 'expired'
+
+    def __str__(self) -> str:
+        return self.value
+
+
+_MESSAGES = {
+    OfflineLicenseErrorCode.MALFORMED: 'The offline license is not a valid license file or token.',
+    OfflineLicenseErrorCode.UNSUPPORTED_ALGORITHM: 'The offline license uses an unsupported signing algorithm.',
+    OfflineLicenseErrorCode.UNKNOWN_KEY: 'The offline license was not signed by a trusted public key.',
+    OfflineLicenseErrorCode.BAD_SIGNATURE: 'The offline license signature is invalid.',
+    OfflineLicenseErrorCode.WRONG_TYPE: 'The token is not an offline license.',
+    OfflineLicenseErrorCode.WRONG_PRODUCT: 'The offline license is for a different product.',
+    OfflineLicenseErrorCode.WRONG_MACHINE: 'The offline license is for a different machine.',
+    OfflineLicenseErrorCode.EXPIRED: 'The offline license has expired.',
+}
+
+
+class OfflineLicenseError(Exception):
+    """
+    Raised when an offline license fails verification.
+
+    ``code`` is an :class:`OfflineLicenseErrorCode` (a ``str``), e.g. ``"expired"``.
+    The message never contains the license key.
+    """
+
+    def __init__(self, code: OfflineLicenseErrorCode, message: str | None = None):
+        self.code = code
+        self.message = message or _MESSAGES[code]
+        super().__init__(self.message)
+
+
+@dataclass(frozen=True)
+class OfflineLicense:
+    """A verified offline license. Times are timezone-aware UTC datetimes."""
+
+    license_key: str = field(repr=False)
+    product_id: str
+    machine_code: str
+    key_id: str
+    issued_at: datetime | None
+    expires_at: datetime
+
+
+def _key_id(key: Ed25519PublicKey) -> str:
+    """base64url (no padding) of SHA-256 over the key's SPKI DER, as the server computes it."""
+    der = key.public_bytes(Encoding.DER, PublicFormat.SubjectPublicKeyInfo)
+    return base64.urlsafe_b64encode(hashlib.sha256(der).digest()).rstrip(b'=').decode('ascii')
+
+
+def _load_public_key(pem: str, index: int) -> Ed25519PublicKey:
+    if not isinstance(pem, str):
+        raise TypeError(f'public_keys[{index}] must be a PEM string')
+    try:
+        key = load_pem_public_key(pem.encode('utf-8'))
+    except (ValueError, TypeError, UnsupportedAlgorithm) as err:
+        raise ValueError(f'public_keys[{index}] is not a valid PEM public key') from err
+    if not isinstance(key, Ed25519PublicKey):
+        # A valid PEM of the wrong key type is a bad value, not a bad type (spec).
+        raise ValueError(f'public_keys[{index}] is not an Ed25519 public key')  # noqa: TRY004
+    return key
+
+
+def _b64url_decode(segment: str) -> bytes | None:
+    try:
+        return base64.urlsafe_b64decode(segment + '=' * (-len(segment) % 4))
+    except (binascii.Error, ValueError):
+        return None
+
+
+def _reject_constant(name: str) -> Any:
+    # JSON has no NaN or Infinity; Python's json module accepts them by default.
+    raise ValueError(f'invalid JSON constant {name}')
+
+
+def _parse_json(text: str) -> Any:
+    """json.loads, raising ValueError for anything JSON.parse would reject."""
+    try:
+        return json.loads(text, parse_constant=_reject_constant)
+    except RecursionError as err:  # deeply nested input
+        raise ValueError('JSON nested too deeply') from err
+
+
+def _decode_json_object(segment: str) -> dict[str, Any] | None:
+    raw = _b64url_decode(segment)
+    if raw is None:
+        return None
+    try:
+        value = _parse_json(raw.decode('utf-8', errors='replace'))
+    except ValueError:
+        return None
+    return value if isinstance(value, dict) else None
+
+
+def _is_number(value: Any) -> bool:
+    # bool is a subclass of int in Python; JSON true/false are not numbers.
+    return isinstance(value, (int, float)) and not isinstance(value, bool)
+
+
+def _to_datetime(seconds: float) -> datetime | None:
+    try:
+        if not math.isfinite(seconds):
+            return None
+        return _EPOCH + timedelta(seconds=seconds)
+    except (OverflowError, ValueError):
+        return None
+
+
+def verify_offline_license(
+    license: str,
+    *,
+    public_keys: Sequence[str],
+    product_id: str,
+    machine_code: str,
+    now: datetime | None = None,
+    clock_skew: float = DEFAULT_CLOCK_SKEW,
+) -> OfflineLicense:
+    """
+    Verifies an offline license locally and returns its claims.
+
+    :param license: The ``.lic`` file contents (JSON string) or the bare signed token.
+    :param public_keys: One or more trusted Ed25519 public keys (SPKI PEM strings)
+        from Developer -> Public Keys.
+    :param product_id: The product this app is. Must equal the license's product.
+    :param machine_code: This machine's code. Must equal the license's machine code.
+    :param now: The time to check expiry against. Must be timezone-aware; naive
+        datetimes are rejected. Defaults to the system clock. To guard against
+        clock rollback, pass ``max(system time, last trusted time)``.
+    :param clock_skew: Seconds of leeway on expiry, 0 to 3600. Defaults to 60.
+    :returns: The verified :class:`OfflineLicense`.
+    :raises OfflineLicenseError: The license failed verification; see ``.code``.
+    :raises ValueError: An argument is invalid (no keys, a key that is not an
+        Ed25519 public key PEM, an empty product or machine code, a naive ``now``,
+        or ``clock_skew`` out of range).
+    :raises TypeError: An argument has the wrong type.
+    """
+    if not isinstance(license, str):
+        raise TypeError('license must be a string')
+    if isinstance(public_keys, (str, bytes)):
+        raise TypeError('public_keys must be a sequence of PEM strings, not a single string')
+    public_keys = list(public_keys)
+    if not public_keys:
+        raise ValueError('public_keys must contain at least one key')
+    if not isinstance(product_id, str):
+        raise TypeError('product_id must be a string')
+    if not product_id:
+        raise ValueError('product_id is required')
+    if not isinstance(machine_code, str):
+        raise TypeError('machine_code must be a string')
+    if not machine_code:
+        raise ValueError('machine_code is required')
+    if not _is_number(clock_skew):
+        raise TypeError('clock_skew must be a number of seconds')
+    if not 0 <= clock_skew <= MAX_CLOCK_SKEW:
+        raise ValueError(f'clock_skew must be between 0 and {MAX_CLOCK_SKEW} seconds')
+    if now is None:
+        now = datetime.now(timezone.utc)
+    elif not isinstance(now, datetime):
+        raise TypeError('now must be a datetime')
+    elif now.tzinfo is None or now.utcoffset() is None:
+        raise ValueError('now must be timezone-aware, e.g. datetime.now(timezone.utc)')
+
+    keys: dict[str, Ed25519PublicKey] = {}
+    for index, pem in enumerate(public_keys):
+        key = _load_public_key(pem, index)
+        keys[_key_id(key)] = key
+
+    # 1. Parse: a .lic file (JSON) or a bare token.
+    token = license.strip(_WHITESPACE)
+    if token.startswith('{'):
+        try:
+            file = _parse_json(token)
+        except ValueError:
+            raise OfflineLicenseError(OfflineLicenseErrorCode.MALFORMED) from None
+        if not isinstance(file, dict) or not isinstance(file.get('signedKey'), str):
+            raise OfflineLicenseError(OfflineLicenseErrorCode.MALFORMED)
+        token = file['signedKey']
+    parts = token.split('.')
+    if len(parts) != 3 or not all(_SEGMENT.fullmatch(part) for part in parts):
+        raise OfflineLicenseError(OfflineLicenseErrorCode.MALFORMED)
+    header_b64, payload_b64, signature_b64 = parts
+    header = _decode_json_object(header_b64)
+    payload = _decode_json_object(payload_b64)
+    if header is None or payload is None:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.MALFORMED)
+
+    # 2. Algorithm: exactly EdDSA, no critical extensions.
+    if header.get('alg') != 'EdDSA' or 'crit' in header:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.UNSUPPORTED_ALGORITHM)
+
+    # 3. Key: the kid must name a trusted key.
+    kid = header.get('kid')
+    key = keys.get(kid) if isinstance(kid, str) else None
+    if key is None:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.UNKNOWN_KEY)
+
+    # 4. Signature over the segments exactly as received.
+    signature = _b64url_decode(signature_b64)
+    if signature is None or len(signature) != 64:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.BAD_SIGNATURE)
+    try:
+        key.verify(signature, f'{header_b64}.{payload_b64}'.encode('ascii'))
+    except InvalidSignature:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.BAD_SIGNATURE) from None
+
+    # 5-7. Claims, compared exactly (no trimming or case folding).
+    if payload.get('type') != 'offline':
+        raise OfflineLicenseError(OfflineLicenseErrorCode.WRONG_TYPE)
+    if payload.get('productId') != product_id:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.WRONG_PRODUCT)
+    if payload.get('machineCode') != machine_code:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.WRONG_MACHINE)
+
+    # 8. Shape of the remaining claims, then 9. expiry.
+    exp = payload.get('exp')
+    sub = payload.get('sub')
+    iat = payload.get('iat')
+    expires_at = _to_datetime(exp) if _is_number(exp) else None
+    if expires_at is None:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.MALFORMED)
+    if not isinstance(sub, str) or not sub:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.MALFORMED)
+    if not now.timestamp() < exp + clock_skew:
+        raise OfflineLicenseError(OfflineLicenseErrorCode.EXPIRED)
+
+    return OfflineLicense(
+        license_key=sub,
+        product_id=product_id,
+        machine_code=machine_code,
+        key_id=kid,
+        issued_at=_to_datetime(iat) if _is_number(iat) else None,
+        expires_at=expires_at,
+    )

{keymint-2.6.0 → keymint-2.7.0}/keymint/types.py

@@ -123,6 +123,14 @@ class UnblockKeyResponse(TypedDict):
     message: str
     code: int
 
+class DeleteKeyParams(TypedDict):
+    productId: str
+    licenseKey: str
+
+class DeleteKeyResponse(TypedDict):
+    message: str
+    code: int
+
 # Customer Management Types
 
 class CreateCustomerParams(TypedDict):

{keymint-2.6.0 → keymint-2.7.0/keymint.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keymint
-Version: 2.6.0
+Version: 2.7.0
 Summary: License key validation, activation, and management for Python. Supports node-locking, offline licensing, and hardware fingerprinting.
 Home-page: https://github.com/keymint-dev/keymint-python
 Author: KeyMint
@@ -24,6 +24,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.32.4
+Requires-Dist: cryptography>=41
 Provides-Extra: dev
 Requires-Dist: pytest>=6.0; extra == "dev"
 Requires-Dist: pytest-cov; extra == "dev"
@@ -51,6 +52,7 @@ A professional, production-ready SDK for integrating with the Keymint API in Pyt
 - **Type hints**: Full type hint support for better IDE integration and code safety.
 - **Comprehensive**: Complete API coverage for all Keymint endpoints.
 - **Consistent error handling**: All API errors are returned as structured objects or exceptions.
+- **Offline licenses**: Verify signed `.lic` files locally with `verify_offline_license`.
 - **Machine Identity**: Built-in utilities for hardware fingerprinting and stable installation IDs.
 
 ## Installation
@@ -111,6 +113,81 @@ else:
 
 Store the last `expirationDate` you received. An expired license fails activation with the same generic invalid-key error as a wrong key, so the stored date is how your app can tell the user the license expired on that date instead of calling the key invalid.
 
+## Offline Licenses
+
+An offline license is a `.lic` file holding a token signed with your organization's Ed25519 key. Your app verifies it locally with `verify_offline_license`, with no network call.
+
+1. **Get the `.lic` file** from the dashboard's Offline License dialog, or with `sign_key` from your own backend (it needs an admin API key, so never call it from the shipped app). The `hostId` you sign for becomes the license's machine code, so use the ID the customer's machine reports, e.g. `identity.get_or_create_installation_id()`.
+
+   ```python
+   # On your server, with host_id sent by the customer's machine:
+   result = sdk.sign_key({'productId': product_id, 'licenseKey': license_key, 'hostId': host_id})
+   lic = result['file']  # the .lic contents; deliver this to the customer
+   ```
+
+2. **Bundle your public key** with the app: copy the PEM from **Developer → Public Keys** in the dashboard. It is a public key, so shipping it is safe.
+
+3. **Verify** with the product ID and this machine's code:
+
+   ```python
+   from keymint import OfflineLicenseError, identity, verify_offline_license
+
+   PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----
+   MCowBQYDK2VwAyEA...
+   -----END PUBLIC KEY-----
+   """
+
+   with open('license.lic', encoding='utf-8') as f:
+       lic = f.read()
+
+   try:
+       offline = verify_offline_license(
+           lic,
+           public_keys=[PUBLIC_KEY],
+           product_id='prod_...',  # this app's product ID
+           machine_code=identity.get_or_create_installation_id(),
+       )
+       print(f'Licensed until {offline.expires_at:%Y-%m-%d}')
+   except OfflineLicenseError as err:
+       if err.code == 'expired':
+           ...  # ask the customer to renew or reconnect
+       elif err.code in ('wrong_product', 'wrong_machine'):
+           ...  # a real license, but not for this product or this machine
+       else:
+           ...  # malformed, unsupported_algorithm, unknown_key, bad_signature, wrong_type: not a valid license
+   ```
+
+`verify_offline_license` accepts the `.lic` file contents or the bare token and returns an `OfflineLicense` with `license_key`, `product_id`, `machine_code`, `key_id`, `issued_at` (or `None`) and `expires_at` (timezone-aware UTC datetimes). On failure it raises `OfflineLicenseError`; `err.code` is one of:
+
+| Code | Meaning |
+|---|---|
+| `malformed` | Not a license file or token, or required claims (`exp`, `sub`) are missing or invalid. |
+| `unsupported_algorithm` | The token is not signed with EdDSA (e.g. `none`, `HS256`). |
+| `unknown_key` | Signed by a key that isn't in `public_keys`. |
+| `bad_signature` | The signature doesn't match: the file was altered or forged. |
+| `wrong_type` | The token is not an offline license. |
+| `wrong_product` | The license is for a different product. |
+| `wrong_machine` | The license is for a different machine. |
+| `expired` | Past its expiry, plus `clock_skew` (default 60 seconds, max 3600). |
+
+Bad arguments (no public keys, a PEM that isn't an Ed25519 public key, an empty `product_id` or `machine_code`, `clock_skew` outside 0..3600, a naive `now`) raise `ValueError` or `TypeError`, not `OfflineLicenseError`.
+
+**`product_id` is required.** One signing key covers all of an organization's products, so without the product check a license for a cheap product would unlock an expensive one.
+
+**Clock rollback.** The SDK can't tell if the system clock was set back. To guard against it, store the latest time you have trusted (for example, after each successful run) and pass the later of the two as `now`. `now` must be timezone-aware:
+
+```python
+from datetime import datetime, timezone
+
+now = max(datetime.now(timezone.utc), last_trusted_time)
+offline = verify_offline_license(lic, public_keys=[PUBLIC_KEY], product_id=product_id,
+                                 machine_code=machine_code, now=now)
+```
+
+`public_keys` accepts several keys, so apps are ready for key rotation. An offline license stays valid until it expires; it can't be revoked before then.
+
+Offline verification uses the [`cryptography`](https://pypi.org/project/cryptography/) package, which `pip install keymint` installs (`cryptography>=41`).
+
 ## Machine Identity
 Keymint provides utilities to uniquely identify machines for node-locking:
 
@@ -130,6 +207,7 @@ Keymint provides utilities to uniquely identify machines for node-locking:
 | `update_key`     | Updates an existing license key.                |
 | `block_key`      | Blocks a license key.                           |
 | `unblock_key`    | Unblocks a previously blocked license key.      |
+| `delete_key`     | Permanently deletes a license key.              |
 | `sign_key`       | Signs a key for offline validation using an admin API key.|
 | `floating_checkout` | Checks out a floating license seat.          |
 | `floating_heartbeat`| Sends a heartbeat to keep a session alive.   |
@@ -145,7 +223,7 @@ Keymint provides utilities to uniquely identify machines for node-locking:
 | `get_customer_with_keys`| Gets a customer along with their license keys.   |
 | `update_customer`       | Updates customer information.                    |
 | `toggle_customer_status`| Toggles customer active status.                  |
-| `delete_customer`       | Permanently deletes a customer and their keys.   |
+| `delete_customer`       | Deletes a customer. Their license keys are kept; use `delete_key` to remove them. |
 
 ### Webhook Verification
 

{keymint-2.6.0 → keymint-2.7.0}/keymint.egg-info/SOURCES.txt

@@ -5,10 +5,12 @@ setup.py
 keymint/__init__.py
 keymint/_version.py
 keymint/identity.py
+keymint/offline.py
 keymint/types.py
 keymint.egg-info/PKG-INFO
 keymint.egg-info/SOURCES.txt
 keymint.egg-info/dependency_links.txt
 keymint.egg-info/requires.txt
 keymint.egg-info/top_level.txt
-tests/test_contracts.py
+tests/test_contracts.py
+tests/test_offline.py

{keymint-2.6.0 → keymint-2.7.0}/keymint.egg-info/requires.txt

@@ -1,4 +1,5 @@
 requests>=2.32.4
+cryptography>=41
 
 [dev]
 pytest>=6.0

{keymint-2.6.0 → keymint-2.7.0}/setup.py

@@ -5,7 +5,7 @@ with open("README.md", "r", encoding="utf-8") as fh:
 
 setup(
     name="keymint",
-    version="2.6.0",
+    version="2.7.0",
     author="KeyMint",
     author_email="cliff@keymint.dev",
     description="License key validation, activation, and management for Python. Supports node-locking, offline licensing, and hardware fingerprinting.",
@@ -35,6 +35,7 @@ setup(
     python_requires='>=3.10',
     install_requires=[
         'requests>=2.32.4',
+        'cryptography>=41',
     ],
     extras_require={
         'dev': [

{keymint-2.6.0 → keymint-2.7.0}/tests/test_contracts.py

@@ -83,3 +83,44 @@ def test_floating_checkout_returns_expiration_date_separate_from_lease(mock_post
     assert mock_post.call_args.args[0].endswith("/key/checkout")
     assert result["expirationDate"] == expiration_date
     assert result["expiresAt"] == "2026-10-26T12:05:00.000Z"
+
+
+@patch("keymint.requests.delete")
+def test_delete_key_sends_json_body_not_url(mock_delete):
+    mock_delete.return_value = response({"message": "Key deleted", "code": 0})
+
+    result = KeyMint("admin_test").delete_key({"productId": "product_123", "licenseKey": "secret/license+key"})
+
+    args, kwargs = mock_delete.call_args
+    url = args[0]
+    assert url == "https://api.keymint.dev/key"
+    assert kwargs["json"] == {"productId": "product_123", "licenseKey": "secret/license+key"}
+    assert kwargs["params"] is None
+    assert "secret" not in url and "license" not in url
+    assert "x-license-key" not in kwargs["headers"]
+    assert kwargs["headers"]["Authorization"] == "Bearer admin_test"
+    assert kwargs["headers"]["Content-Type"] == "application/json"
+    assert result == {"message": "Key deleted", "code": 0}
+
+
+@patch("keymint.requests.delete")
+def test_delete_key_raises_on_404(mock_delete):
+    mock_delete.return_value = response({"message": "Invalid license key", "code": 1}, 404)
+
+    with pytest.raises(KeyMintApiError, match="Invalid license key") as excinfo:
+        KeyMint("admin_test").delete_key({"productId": "product_123", "licenseKey": "license_123"})
+
+    assert excinfo.value.status == 404
+    assert excinfo.value.code == 1
+
+
+@patch("keymint.requests.delete")
+def test_delete_customer_still_uses_query_params_and_no_body(mock_delete):
+    mock_delete.return_value = response({"action": "deleteCustomer", "status": True, "code": 0})
+
+    KeyMint("admin_test").delete_customer({"customerId": "cust_123"})
+
+    args, kwargs = mock_delete.call_args
+    assert args[0] == "https://api.keymint.dev/customer/by-id"
+    assert kwargs["params"] == {"customerId": "cust_123"}
+    assert set(kwargs) == {"params", "headers"}

keymint-2.7.0/tests/test_offline.py

@@ -0,0 +1,252 @@
+import base64
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric import ed25519, rsa
+from cryptography.hazmat.primitives.serialization import (
+    Encoding,
+    NoEncryption,
+    PrivateFormat,
+    PublicFormat,
+)
+
+from keymint import (
+    OfflineLicense,
+    OfflineLicenseError,
+    OfflineLicenseErrorCode,
+    verify_offline_license,
+)
+from keymint.offline import _key_id, _load_public_key
+
+FIXTURES = json.loads(
+    (Path(__file__).parent / "fixtures" / "offline-license-fixtures.json").read_text(encoding="utf-8")
+)
+PUBLIC_KEYS = FIXTURES["publicKeys"]
+VALID_CASE = FIXTURES["cases"][0]
+PRODUCT_ID = VALID_CASE["options"]["productId"]
+MACHINE_CODE = VALID_CASE["options"]["machineCode"]
+NOW = datetime.fromtimestamp(VALID_CASE["options"]["now"], tz=timezone.utc)
+
+
+def unix(value):
+    return None if value is None else value.timestamp()
+
+
+def verify_case(case):
+    options = case["options"]
+    kwargs = {
+        "public_keys": PUBLIC_KEYS,
+        "product_id": options["productId"],
+        "machine_code": options["machineCode"],
+        "now": datetime.fromtimestamp(options["now"], tz=timezone.utc),
+    }
+    if "clockSkew" in options:
+        kwargs["clock_skew"] = options["clockSkew"]
+    return verify_offline_license(case["input"], **kwargs)
+
+
+def test_fixture_file_has_all_cases():
+    assert len(FIXTURES["cases"]) == 34
+
+
+def test_key_ids_match_fixtures():
+    assert [_key_id(_load_public_key(pem, i)) for i, pem in enumerate(PUBLIC_KEYS)] == FIXTURES["keyIds"]
+
+
+@pytest.mark.parametrize("case", FIXTURES["cases"], ids=[c["name"] for c in FIXTURES["cases"]])
+def test_shared_fixture(case):
+    expect = case["expect"]
+    if expect["valid"]:
+        result = verify_case(case)
+        expected = expect["license"]
+        assert isinstance(result, OfflineLicense)
+        assert result.license_key == expected["licenseKey"]
+        assert result.product_id == expected["productId"]
+        assert result.machine_code == expected["machineCode"]
+        assert result.key_id == expected["keyId"]
+        assert unix(result.issued_at) == expected["issuedAt"]
+        assert unix(result.expires_at) == expected["expiresAt"]
+        assert result.expires_at.tzinfo is timezone.utc
+    else:
+        with pytest.raises(OfflineLicenseError) as excinfo:
+            verify_case(case)
+        assert excinfo.value.code == expect["error"]
+        assert isinstance(excinfo.value.code, OfflineLicenseErrorCode)
+
+
+def test_errors_never_contain_the_license_key():
+    case = next(c for c in FIXTURES["cases"] if c["name"] == "wrong product")
+    with pytest.raises(OfflineLicenseError) as excinfo:
+        verify_case(case)
+    assert "KM-ABCD" not in str(excinfo.value)
+    assert "KM-ABCD" not in repr(excinfo.value)
+
+
+def test_repr_hides_the_license_key():
+    result = verify_case(VALID_CASE)
+    assert "KM-ABCD" not in repr(result)
+
+
+def test_accepts_now_in_another_timezone():
+    from datetime import timedelta
+
+    tz = timezone(timedelta(hours=-5))
+    result = verify_offline_license(
+        VALID_CASE["input"], public_keys=PUBLIC_KEYS, product_id=PRODUCT_ID,
+        machine_code=MACHINE_CODE, now=NOW.astimezone(tz),
+    )
+    assert result.license_key == "KM-ABCD-1234-EFGH-5678"
+
+
+# ─── Tokens signed here, for Python-specific edge cases ─────────────────
+
+def b64url(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def sign(payload_json: str):
+    private_key = ed25519.Ed25519PrivateKey.generate()
+    pem = private_key.public_key().public_bytes(Encoding.PEM, PublicFormat.SubjectPublicKeyInfo).decode()
+    header = json.dumps({"alg": "EdDSA", "kid": _key_id(private_key.public_key())})
+    signing_input = f"{b64url(header.encode())}.{b64url(payload_json.encode())}"
+    token = f"{signing_input}.{b64url(private_key.sign(signing_input.encode('ascii')))}"
+    return token, pem
+
+
+def claims(**overrides):
+    payload = {
+        "productId": PRODUCT_ID, "machineCode": MACHINE_CODE, "type": "offline",
+        "iat": 1799913600, "exp": 1802592000, "sub": "KM-TEST",
+    }
+    payload.update(overrides)
+    return json.dumps(payload)
+
+
+def verify_signed(payload_json: str):
+    token, pem = sign(payload_json)
+    return verify_offline_license(
+        token, public_keys=[pem], product_id=PRODUCT_ID, machine_code=MACHINE_CODE, now=NOW,
+    )
+
+
+@pytest.mark.parametrize("payload_json", [
+    claims(exp=True),
+    claims(exp=None),
+    claims(exp="1802592000"),
+    claims(sub=""),
+    claims(sub=123),
+    claims().replace("1802592000", "NaN"),
+    claims().replace("1802592000", "Infinity"),
+    claims().replace("1802592000", "1e400"),
+    claims().replace("1802592000", "1" + "0" * 400),
+], ids=["bool", "null", "string", "empty sub", "number sub", "NaN", "Infinity", "huge float", "huge int"])
+def test_bad_exp_or_sub_is_malformed(payload_json):
+    with pytest.raises(OfflineLicenseError) as excinfo:
+        verify_signed(payload_json)
+    assert excinfo.value.code == "malformed"
+
+
+def test_bool_iat_is_not_returned():
+    assert verify_signed(claims(iat=True)).issued_at is None
+
+
+def test_missing_iat_is_none():
+    payload = json.loads(claims())
+    del payload["iat"]
+    assert verify_signed(json.dumps(payload)).issued_at is None
+
+
+def test_float_exp_is_accepted():
+    result = verify_signed(claims(exp=1802592000.5))
+    assert unix(result.expires_at) == 1802592000.5
+
+
+def test_trailing_newline_in_a_segment_is_malformed():
+    token, pem = sign(claims())
+    header, payload, signature = token.split(".")
+    with pytest.raises(OfflineLicenseError) as excinfo:
+        verify_offline_license(
+            f"{header}\n.{payload}.{signature}", public_keys=[pem],
+            product_id=PRODUCT_ID, machine_code=MACHINE_CODE, now=NOW,
+        )
+    assert excinfo.value.code == "malformed"
+
+
+@pytest.mark.parametrize("value", [
+    '{"signedKey":' + "[" * 100_000,
+    b64url(b'{"a":' + b"[" * 100_000) + ".e30.",
+], ids=[".lic", "token header"])
+def test_deeply_nested_json_is_malformed(value):
+    with pytest.raises(OfflineLicenseError) as excinfo:
+        verify_offline_license(
+            value, public_keys=PUBLIC_KEYS, product_id=PRODUCT_ID, machine_code=MACHINE_CODE, now=NOW,
+        )
+    assert excinfo.value.code == "malformed"
+
+
+# ─── Argument errors ────────────────────────────────────────────────────
+
+def rsa_public_pem():
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    return key.public_key().public_bytes(Encoding.PEM, PublicFormat.SubjectPublicKeyInfo).decode()
+
+
+def ed25519_private_pem():
+    key = ed25519.Ed25519PrivateKey.generate()
+    return key.private_bytes(Encoding.PEM, PrivateFormat.PKCS8, NoEncryption()).decode()
+
+
+def call(**overrides):
+    kwargs = {
+        "public_keys": PUBLIC_KEYS, "product_id": PRODUCT_ID,
+        "machine_code": MACHINE_CODE, "now": NOW,
+    }
+    kwargs.update(overrides)
+    return verify_offline_license(VALID_CASE["input"], **kwargs)
+
+
+@pytest.mark.parametrize("overrides", [
+    {"public_keys": []},
+    {"public_keys": ["not a pem"]},
+    {"public_keys": ["-----BEGIN PUBLIC KEY-----\nAAAA\n-----END PUBLIC KEY-----\n"]},
+    {"public_keys": [rsa_public_pem()]},
+    {"public_keys": [ed25519_private_pem()]},
+    {"product_id": ""},
+    {"machine_code": ""},
+    {"clock_skew": -1},
+    {"clock_skew": 3601},
+    {"clock_skew": float("nan")},
+    {"now": datetime(2027, 1, 15, 8, 0, 0)},
+], ids=[
+    "no keys", "garbage pem", "truncated pem", "rsa key", "private key",
+    "empty product", "empty machine", "negative skew", "skew over an hour", "nan skew", "naive now",
+])
+def test_bad_arguments_raise_value_error(overrides):
+    with pytest.raises(ValueError):
+        call(**overrides)
+
+
+@pytest.mark.parametrize("overrides", [
+    {"public_keys": PUBLIC_KEYS[0]},
+    {"public_keys": [b"bytes"]},
+    {"product_id": None},
+    {"machine_code": 1},
+    {"clock_skew": True},
+    {"clock_skew": "60"},
+    {"now": 1800000000},
+], ids=["single string", "bytes key", "product none", "machine int", "bool skew", "string skew", "int now"])
+def test_wrong_argument_types_raise_type_error(overrides):
+    with pytest.raises(TypeError):
+        call(**overrides)
+
+
+def test_clock_skew_bounds_are_inclusive():
+    assert call(clock_skew=0).license_key
+    assert call(clock_skew=3600).license_key
+
+
+def test_rsa_key_error_names_ed25519():
+    with pytest.raises(ValueError, match="Ed25519"):
+        call(public_keys=[rsa_public_pem()])