License API v2

$pair   = sodium_crypto_sign_keypair();
file_put_contents($keyPath, base64_encode($pair));   // chmod 0600
$secret = sodium_crypto_sign_secretkey($pair);       // signs requests — keep on device
$public = sodium_crypto_sign_publickey($pair);       // sent on /activate
$devicePublicKeyB64 = base64_encode($public);

v2.lic-req
{HTTP_METHOD}          e.g. POST
{path}                 e.g. api/v2/license/activate   (no leading slash)
{timestamp}            unix seconds
{nonce}                random hex (16 bytes)
{counter}              monotonic integer, +1 per request
{license_key}
{activation_id}        empty string on /activate
{device_public_key}    base64
{fingerprint_hash}     sha256( domain \x1f server \x1f hardware )

$fpHash = hash('sha256', implode("\x1f", [$fp['domain'] ?? '', $fp['server'] ?? '', $fp['hardware'] ?? '']));
$message = implode("\n", [
  'v2.lic-req', 'POST', 'api/v2/license/activate',
  $timestamp, $nonce, $counter, $licenseKey, $activationId ?? '', $devicePublicKeyB64, $fpHash,
]);
$deviceSig = base64_encode(sodium_crypto_sign_detached($message, $deviceSecret));

use KodeHarbor\License\LicenseGuard;

// 1) Once, in your setup wizard:
LicenseGuard::activate($licenseKey);        // mints device key, enrolls, stores + verifies tokens

// 2) Anywhere you enforce — the ONLY call sites you ever need:
LicenseGuard::ok();                          // bool — active or grace?
LicenseGuard::has('reports.advanced');       // bool — entitlement present?

// 3) Keep the lease + CRL fresh (schedule daily):
LicenseGuard::heartbeat();

// 4) Uninstaller — release the seat:
LicenseGuard::deactivate();

$body = [ 'license_key' => $key, 'device_public_key' => $pub, 'fingerprint' => $fp,
          'timestamp' => time(), 'nonce' => bin2hex(random_bytes(16)), 'counter' => 1,
          'device_sig' => $sigOverCanonicalInput ];   // sign with POST + api/v2/license/activate
$requestCode  = base64_encode(json_encode($body));      // paste into the portal

// portal returns $responseCode:
$result = json_decode(base64_decode($responseCode), true); // {success, activation_id, lease, ...}

function verifyToken(string $token, string $pubKeyB64): ?array {
    $pub = base64_decode($pubKeyB64);
    $p = explode('.', $token);
    if (count($p) < 3 || $p[0] !== 'v4' || $p[1] !== 'public') return null;
    $body = sodium_base642bin(strtr($p[2],'-_','+/'), SODIUM_BASE64_VARIANT_ORIGINAL_NO_PADDING);
    $payload = substr($body, 0, -SODIUM_CRYPTO_SIGN_BYTES);
    $sig     = substr($body, -SODIUM_CRYPTO_SIGN_BYTES);
    $footer  = isset($p[3]) ? sodium_base642bin(strtr($p[3],'-_','+/'), 5) : '';
    // PAE("v4.public.", payload, footer, "")
    $pae = pae(['v4.public.', $payload, $footer, '']);
    return sodium_crypto_sign_verify_detached($sig, $pae, $pub) ? json_decode($payload, true) : null;
}
// A lease is valid while now < exp; degraded while now < grace_until; otherwise stop.

{
  "success": false,
  "error":   "DOMAIN_LOCKED",          // stable machine code — switch on this
  "message": "This license has already been activated on yourdomain.com. ...",
  "registered_domain": "yourdomain.com" // present on DOMAIN_LOCKED
}

// Emit valid JSON on every path — never a blank page.
function emitJson(array $data): void {
    $json = json_encode($data, JSON_INVALID_UTF8_SUBSTITUTE | JSON_UNESCAPED_SLASHES);
    echo $json !== false
        ? $json
        : json_encode(['success' => false, 'message' => 'Encoding error: '.json_last_error_msg()]);
}

header('Content-Type: application/json');

// 1) Signing needs libsodium — fail loudly, not blankly.
if (!function_exists('sodium_crypto_sign_keypair')) {
    http_response_code(500);
    emitJson(['success' => false, 'error' => 'NO_LIBSODIUM',
              'message' => 'Enable the PHP "sodium" extension to activate a license.']);
    exit;
}

try {
    // $status = HTTP code, $body = raw response from the License Platform.
    [$status, $body] = callLicenseApi('/api/v2/license/activate', $payload);
    $data = json_decode($body, true);

    http_response_code($status ?: 502);
    emitJson(is_array($data) ? $data
        : ['success' => false,
           'message' => $body !== '' ? $body : 'No response from the license server.']);
} catch (\Throwable $e) {
    http_response_code(500);
    emitJson(['success' => false, 'error' => 'CLIENT_ERROR', 'message' => $e->getMessage()]);
}