Signing keys

License tokens are signed with Ed25519. The private key exists in one place only: the encrypted environment of the licensing backend. The corresponding public keys are baked into every server build in keys.properties, keyed by kid. A server refuses to boot on any token whose kid is not present.

Token format

<base64url(payload)>.<base64url(signature)>. Payload is CBOR-encoded with a fixed key order:v, iss, sub, iat, nbf, exp, features, kid. Verification is offline; no network call is required at server boot.

Revocation

Revocation is bookkeeping, not a cryptographic recall. A revoked token remains cryptographically valid on any server that still has it. Revocation is used to terminate the commercial relationship (refunds, fraud) and is displayed in the operator’s portal.

Reporting

Report security issues privately to support@nullsect0r.dev. We aim to acknowledge within one business day and fix critical issues within seven. We publish an advisory and credit reporters that ask for credit.

Sub-processors

Full list on Privacy. All sub-processors are contracted under GDPR-compliant data-processing addenda.