Platform, Architecture & Foundations

Server-issued JWT model

From v1.5.37 onward the product uses a server-issued JWT licence model. SMVR-format licence keys are validated against the activation server at https://listener.samvracore.tech/licences/activate. Tokens are Ed25519-signed JWTs, and the public key is embedded at build time in pkg/license/server.go. Each token has a 90-day TTL, with background revalidation every 7 days against the /licences/verify endpoint.

Machine fingerprint

Activation is bound to a machine fingerprint computed per platform. On Linux it reads /etc/machine-id, on macOS the IOPlatformUUID, and on Windows the registry value at HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid. This ties a licence token to the host it was activated on.

Token resolution and safety

The token path is resolved through a defined chain. It first checks the SAMVRACORE_LICENCE_TOKEN_PATH environment variable, then ${SAMVRACORE_DATA_DIR}/licence.token, then on Windows %ProgramData%\SamvraCore ERP\licence.token, then the user config directory, and finally /var/lib/. A deliberate token-loss safety rule keeps an operator in the loop: if the token is invalid the install wizard is launched rather than a silent re-fetch being attempted. This ensures a human confirms re-activation instead of the system quietly reaching out to the licence server.