Offline-first licensing with RSA-signed JWTs

A license check that needs your server on every start makes your uptime your customer's problem. Signing the license instead moves the proof into the license itself.

The idea

Sign the license claims with a private key you keep. Ship the public key with the client. The client verifies the signature locally, so it needs no network call to know the license is genuine and unexpired.

Why RSA and JWT

JWT is a standard container for claims with an expiry. RSA means the verifier holds only a public key, so a leaked client cannot mint licenses. A shared-secret scheme would put the signing power inside every client.

The honest trade-off

Offline verification cannot know about a revocation it has not heard of. Revocation is therefore bounded by two things: how long a token lives, and how often the client checks in when it can. Short tokens with a quiet refresh give you tighter control at the cost of more check-ins.

Keys and rollout

• Plan key rotation before the first release. Give each token a key id so old and new keys can both verify during a transition.
• A phased migration means v1 and v2 run side by side. Decide what an old client sees when it meets a v2 license.