- How do I install masterix21/laravel-licensing-client in a Laravel application?
- Install it with Composer using composer require masterix21/laravel-licensing-client, then publish the package configuration. You must point licensing-client.issuer at the same issuer value used by your licensing server, and the server must be on v2.0.0. Check your composer.json constraints for the declared PHP and Laravel support floor before installing.
- Does laravel-licensing-client call the licensing server on every request?
- No. It is designed to validate PASETO tokens locally with Ed25519 public keys, so verification stays in-process and fast. The remote server is only needed for issuance, public key discovery, and entitlement refresh. That keeps request-time license checks off the network path.
- Which PHP and Laravel versions does laravel-licensing-client support?
- The package targets PHP 8.4 and 8.5 and its tests run against Laravel 13. Teams on PHP 8.2 or 8.3, or on Laravel 10, 11, or 12, should confirm the actual composer.json constraints rather than infer support from the CI matrix. CI coverage alone is not a declared support floor.
- What breaking changes in v2.0.0 can cause license tokens to be rejected?
- v2.0.0 makes issuer validation strict, so tokens whose issuer does not match licensing-client.issuer are rejected. It also adds certificate chain verification, public key bundle application, and validator initialization from a stored bundle. Two of those changes can turn previously accepted tokens into rejected ones, so treat the upgrade as fail-closed and verify configuration before rollout.
- How does key rotation work with laravel-licensing-client?
- The client supports offline key rotation by applying a public key bundle and initializing the validator from a stored bundle. The licensing server handles issuance and key discovery, while the client maintains the chain of trust locally. If the stored bundle is not refreshed before the server rotates keys, new tokens will fail verification until the app re-fetches.
- What happens if the public key bundle is missing or unavailable at boot?
- Token validator initialization from the stored bundle happens on boot, so an empty or unavailable bundle store can cause licensing to fail before any request is served. This is a cold-start dependency you need to account for in deployment and health checks. Confirm your bundle persistence and refresh behavior before relying on it in production.
- Is the ±60 second clock skew tolerance configurable?
- Yes, the default ±60 second tolerance is configurable. It is reasonable for NTP-synced fleets but may be thin for containerized or edge environments with clock drift. Treat it as a per-deployment tuning parameter and monitor for skew-related verification failures.
- Where does laravel-licensing-client store entitlements and do I need a migration?
- The package adds entitlements storage and retrieval, meaning it now writes state. The available notes do not specify the storage backend, migration behavior, or cache invalidation semantics. Confirm those details in the package documentation before committing, especially the read path cost per request.
- Can I use laravel-licensing-client to gate features in my application?
- Yes. The package is intended for verifying license keys, activating or deactivating installations, checking license status, and gating features through a simple, configurable API. Entitlements storage and retrieval support that flow, but you should confirm the storage backend and read cost before putting it on a hot path. For strict gating, combine local PASETO verification with your own application-level authorization checks.
- Does laravel-licensing-client work with laravel-licensing server v1.x?
- No, version 2.0.0 of the client explicitly requires the licensing server to be on v2.0.0. The client major and server major are coupled, and rollback is not symmetric: downgrading the client while the server remains on v2.0.0 leaves you in an unsupported combination. Plan client and server upgrades together.