Skip to main content
This guide walks you through embedding Avalex license validation in a Python application. You will generate a stable hardware identifier at startup, post it to the POST /licenses/validate endpoint alongside your license and product IDs, and handle every failure mode — including rate limiting and network outages — so your users always receive a clear and appropriate response.

Installation

The example below relies on the requests library. Install it with pip before proceeding:
If you are working in a virtual environment (recommended), activate it first before running the command above.

Full Example

The following module is self-contained and ready to drop into your project. Adjust AVALEX_API_URL and PRODUCT_ID to match your deployment.

Code Walkthrough

HWID generation (get_hwid) get_hwid reads the most stable machine-unique identifier available on each platform — the BIOS/UEFI product UUID on Windows, /etc/machine-id on Linux, and the IOPlatformUUID on macOS. If all platform-specific methods fail, it falls back to a combination of the hostname and machine architecture. The raw string is then hashed with SHA-256 and the first 32 hex characters are returned. This keeps the HWID short and consistent across calls without exposing the raw hardware value. Request construction validate_license builds a JSON payload with the three required fields — licenseId, productId, and hwid — and posts it to the API with a 5-second timeout. The timeout prevents your application from hanging indefinitely when the validation server is unreachable. Response handling A 200 status code means the server responded successfully. The function reads the valid boolean from the JSON body and returns it directly. Any value other than True (including a missing key) returns False, so your application defaults to a locked state on ambiguous responses. 429 rate-limit handling When the server returns 429 Too Many Requests, the function logs a warning and returns False. You should combine this with your offline cache logic — a 429 is not a license rejection, so you can treat it the same as a network failure and fall back to the cached grace period instead of locking the user out. Network error handling The except requests.RequestException block catches DNS failures, connection timeouts, SSL errors, and all other transport-level problems. Again, return False here and let your caching layer decide whether to allow or deny the session.
Replace AVALEX_API_URL with your production URL and ensure it uses HTTPS. The http://localhost:8080 address is for local development only and must not be shipped in a production build.
Cache the last valid timestamp to disk — ideally in an encrypted format — so your application can support an offline grace period of 24–72 hours. This prevents a temporary network outage or API maintenance window from locking out legitimate users.