shifra-api

Server-driven licensing for Python products. You configure one thing: your license key.

from shifra_api import run

run("YOUR-LICENSE-KEY")

Everything else — which script runs, its version, heartbeat settings, device and network policy, branding — is decided by the Shifra server from your key.

Install

pip install shifra-api

Requires Python 3.9+ and the cryptography package (installed automatically).

Distribution builds are produced by Shifra's build process, which embeds the API origin and the pinned signing key. A plain source checkout has neither and will refuse to start — that is intentional.

Usage

Run the protected script

from shifra_api import run

run("YOUR-LICENSE-KEY")

That single call verifies the license and device, resolves the linked Python product, downloads and verifies its published release, prints the Console Identity configured by the workspace owner, runs the release under heartbeat supervision, applies server-authorized updates, and closes the session on exit.

Check a license without running anything

from shifra_api import Shafra, ShafraError

try:
    license = Shafra("YOUR-LICENSE-KEY").verify()
except ShafraError as error:
    print(error.code, error.message)
else:
    print(license.product_name, license.product_version)
    print("expires:", license.expires_at)

Hold a verified session while your own code runs

from shifra_api import Shafra

with Shafra("YOUR-LICENSE-KEY") as session:
    app.run()          # heartbeat is active for the whole block

The session ends when the block exits. If the license is revoked mid-run, the heartbeat stops and a SessionRevoked error is raised when the block closes.

Errors

Every failure has a stable code. Import the specific class or catch ShafraError:

Connection problems are never reported as signature failures.

About the hardware identity

The client derives a fingerprint from stable machine identifiers and sends only a SHA-256 digest. Raw identifiers never leave your machine. This is a signal for the server to bind licenses to devices, not hardware attestation.

Security notes

• Responses are verified with an Ed25519 key embedded in the build. A signature received over the network is never used as a trust anchor.
• Downloads are checked against a signed digest before anything runs.
• The protected script runs in a supervised subprocess without a temporary plaintext source file, so heartbeat revocation can stop it. Anyone with control of the machine can still inspect process memory — this package protects authorization and integrity, not absolute source secrecy.