# Read license files programmatically

**URL:** <https://community.replicated.com/t/read-license-files-programmatically/1070>\
**Category:** How do I?\
**Tags:** vendor\
**Created:** [December 19, 2022, 12:22pm UTC](https://community.replicated.com/t/read-license-files-programmatically/1070 "2022-12-19T12:22:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmuley](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/dmuley/32/572_2.png) [@dmuley](https://community.replicated.com/u/dmuley)\
**Post date:** [December 19, 2022, 12:22pm UTC](https://community.replicated.com/t/read-license-files-programmatically/1070/1 "2022-12-19T12:22:11Z")

</div>

Hello Team,

We are looking for a license file that can have a list of features in an encrypted way and can be decrypted programmatically and validated against the features that the clients opted for. Is there any way that we can rely on replicated?

if not we are looking for a custom license field but we are not sure how to validate if the license file has been tampered with or is in its original form. Can you guide us on how to verify the authenticity of the license file?

---

<div class="post-metadata">

**Author:** ![jdewinne](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/jdewinne/32/152_2.png) [@jdewinne](https://community.replicated.com/u/jdewinne)\
**Post date:** [December 19, 2022, 4:16pm UTC](https://community.replicated.com/t/read-license-files-programmatically/1070/2 "2022-12-19T16:16:04Z")

</div>

Hi @dmuley

The license does have a signed hash embedded in it. That makes that a customer can not change any fields in it, as it would invalidate the license.  
Also there is an API that you can use the REST api to make sure the “runtime” values are what you expect: [Referencing Custom License Fields | Replicated Docs](https://docs.replicated.com/vendor/licenses-referencing-fields#query-license-fields-from-the-api)

---

<div class="post-metadata">

**Author:** ![dmuley](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/dmuley/32/572_2.png) [@dmuley](https://community.replicated.com/u/dmuley)\
**Post date:** [December 19, 2022, 4:48pm UTC](https://community.replicated.com/t/read-license-files-programmatically/1070/3 "2022-12-19T16:48:02Z")

</div>

Thank you,

by any chance is it possible to validate it on client side ? I am mostly looking to validate certificate for client who dont have inernet access.

---

<div class="post-metadata">

**Author:** ![jdewinne](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/jdewinne/32/152_2.png) [@jdewinne](https://community.replicated.com/u/jdewinne)\
**Post date:** [December 22, 2022, 9:54pm UTC](https://community.replicated.com/t/read-license-files-programmatically/1070/4 "2022-12-22T21:54:01Z")

</div>

Assuming you mean the [verification of the signature](https://github.com/replicatedhq/kots/blob/main/pkg/license/signature.go#L44). Sure you can do that.  
But if it is an offline installation (airgap), kots will also verify the license during installation.