Licensing — RSJ PDF Merge SDK

Test mode

An embedded editor without a licence is not restricted: every feature works. It only shows a banner that says so. That is deliberate — you can build and evaluate the whole integration before you talk to us.

const editor = new PDFMergeSortSplitClass('#editor', {});       // test mode
const licensed = new PDFMergeSortSplitClass('#editor', { apiKey: jwt });

on('license', …) tells you which state the editor is in:

editor.on('license', ({ licensed, reason }) => {
  // { licensed: false, reason: 'no licence presented' }
  // { licensed: true }
  // { licensed: false, reason: 'ERR_JWT_EXPIRED' }
});

The token

A licence is a JSON Web Token signed with ES256 by our auth server:

{
  "aud": "pdfmerge",
  "exp": 1793185127,
  "nbf": 1793000000,
  "authorizedDomains": ["app.example.com"],
  "sub": "example-gmbh"
}

Claim	Checked
`aud`	Required; must be `pdfmerge`.
`exp`	Optional; when present it must be in the future.
`nbf`	Optional; when present it must not be in the future (30 s clock tolerance).
`authorizedDomains`	Optional; when present the page that embedded the editor must be on one of these domains (or a subdomain).

Omitting exp means the token never expires — useful for offline installs, where you replace the licence by shipping a new one.

Where the SDK puts it

config.apiKey is handed to the editor with the configuration, and the editor can ask for it again at any time (licenseRequest); the SDK answers with the same token. An invalid token never disables anything: the editor reports the reason and stays in test mode.

The editor also accepts window.__pdfmerge__ = '<jwt>' before it loads, which only works when the embedding page is same-origin with the editor (self-hosted deployments).

Checking the public key

The editor verifies tokens with the ES256 public key in its build (src/config.production.json, licensePublicKey). A key that does not match the signing key turns every licence into licensePublicKey is not a valid ES256 public key; the message in the banner names the failing check, so a misconfiguration is visible without the console.

Getting one

Licences are per integration, priced by integration and volume — not by page.