Three moving parts. One signature of trust.
Your server signs, your game verifies, and enforcement happens wherever the value lives. The trust anchor is a public key you embed at build time — nothing secret ever ships inside the binary.
Your server signs a license
A license file (VLF) is minted and signed with your Ed25519 key in AWS KMS. The signing key never leaves the HSM — your server just asks KMS for a signature over the canonical bytes.
Your game verifies it offline
The SDK carries your public trust anchor and checks the signature locally — before it reads entitlements, binding or expiry. Verify-before-parse, no network required.
Gate, fuse, or seal
Gate a feature flag, fuse a license into real computation so a wrong key yields wrong output, or run sealed compute server-side. Your call, per surface.
Nothing secret ships in your game.
The only Bindseal material inside your binary is a public key. It can verify a signature but can’t forge one — so pulling your game apart won’t hand an attacker a way to mint licenses under your key. (They can still try to patch the check out — that’s what the other layers are for.)
// The SDK checks the signature FIRST — before // a single field of the license is trusted. const license = await bindseal.verify(vlf); if (!license.ok) { // Bad signature, wrong key, or tampering. return runUnlicensed(); } // Now — and only now — read the payload. const { seat, expires, features } = license.claims; grantAccess(features); // trust earned by a signature ✓