what's the different between meta.expiry and attributes.expiry?

[tnmichael309]

As a topic, what's the difference between meta.expiry and attributes.expiry?
I'm working on an on-prem solution, but I see both expiry appears after I decode&decrypt the license.

My understanding is that:

• meta.expiry is for the license file itself
• attributes.expiry is for the license

How should the software deal with that 2 pieces of information?

[ezekg]

The meta.expiry value is the expiration of the license file itself, set via the license file's TTL. And the data.attributes.expiry value is the expiration of the checked out license "snapshot." All license files have a time-to-live (TTL). Once a license file's TTL has been met, i.e. it has expired, a new one should be checked out. We recommend starting out with a TTL of 30 days (which is the default), and going up or down from there based on your use case. If that's too short, feel free to edit.

Why set a time-to-live? In short: eventual consistency. A TTL gives room for any changes made to the license to eventually propagate into subsequent license files. A good way to think of these would be in terms of a Let's Encrypt TLS certificate, having a short expiry and then re-upping after e.g. 90 days or even 1 year. If the license file never expires, then there is no guarantee license changes would eventually propagate to the offline device.

For most applications, we recommend setting an expiry, so that license files are eventually consistent when it comes to changes in its license's state, e.g. via a rule update, a renewal, an expiration, entitlement changes, or a suspension event, since each time a new license file is checked out, a new "snapshot" of the license is taken.

Now to answer your question — you should check both:

1. Checking meta.expiry allows you to ensure that your license file is still valid. Once expired, you can instruct the end-user to check out a new license file. Most customers have a 30 day grace period for this value.
2. Checking data.attributes.expiry allows you to ensure the license itself is still valid. Once expired, you can instruct your end-user to renew their license. Most customers do not have a grace period for this.

For Keygen EE (on-prem), we use 1 year license files with a 30 day grace period (we use Keygen Cloud to license Keygen EE).