key validation fails if specifying fingerprint on non-fingerprinted key

[nschloe]

When validating the demo key against the API

https://api.keygen.sh/v1/accounts/{demo_account_id}/licenses/actions/validate-key

it all works well. When specifying the machine fingerprint, however, validation fails with a FINGERPRINT_SCOPE_MISMATCH error. That caught me by surprise -- I had assumed that all machines would validate.

I now see that the demo key is floating. Perhaps that's got to do with it?

[ezekg]

This is expected behavior. You're adding a scope (constraint) to the validation request — that the license is associated to a machine with a particular fingerprint — and that constraint is failing. The demo license is valid without a machine (i.e. its policy does not require a fingerprint scope during validation), but that doesn't mean its valid when constraints are specified.

[nschloe]

Interesting! Not knowing the license, is it possible to find out if it requires a fingerprint, or is it just recommended to do API checks both with and without?

[ezekg]

It's not recommended to do multiple checks, no. Your application should have knowledge of what's expected of your licensing model. But, if you for some reason needed to do it dynamically, you can attempt to validate without the fingerprint scope first, and if you receive a FINGERPRINT_SCOPE_REQUIRED validation code, retry with the scope.

But again, this is inefficient and your application should know whether or not to provide the scope.