Hacker News Reader

Ecliptic curve signing. You can produce a message body like “valid_until=2025-02-25” then sign it and distribute it as an api key that’s body+sig. Client can verify signature using public key without a server call (sig validation).

EC beats other signatures because signature is muuuuuch shorter, so it can still look like an API key.

"an ec key" (elliptic curve) is just a detail, this can be done with any crypto library or utility - for example directly with the openssl command: https://stackoverflow.com/questions/15686821/generate-ec-key...

embed the public part in your application and you can verify that something signed with the 'dgst' command and the private key really has been signed with the private key (which you obviously shouldn't publish)

(Note if using plain commands there is more friendly than openssl, minify/signify are much harder to get wrong, but I'm not sure they're as easy to use programmatically in as many languages there are for libcrypto/sodium/etc; this is really just an example)

I use jwt for my app’s licensing. It works great.

Any resources you can provide that will help in understanding how this works?

https://jwt.io/