任何网站，按这份教程都能接上授权

你的站点/
├── auth/
│   └── license-client.php   ← client/license-client.php   # SDK（签名 / 解密 / 面板）
├── auth-proxy.php           ← client/auth-proxy.php         # 同源签名代理（浏览器调它）
├── auth-panel.css           ← client/assets/auth-panel.css  # 授权面板 + 前台提示层样式
└── auth-panel.js            ← client/assets/auth-panel.js   # 授权面板 + 心跳/提示层逻辑

<?php
return [
    'server_url' => 'https://auth.example.com',        // 你的 AuthLink 服务端地址（不带末尾斜杠）
    'app_key'    => 'ak_安装向导下发的密钥',            // ★ 只放服务器端，绝不进前端
    'dat_file'   => __DIR__ . '/storage/license.dat',  // 凭据保存路径（建议移出 web 根）
    'product'    => 'default',                         // 产品标识，与你领取授权码时填的一致即可
];

<?php
require_once __DIR__ . '/auth/license-client.php';
LH_Client::init([
    'server'   => 'https://auth.example.com',
    'app_key'  => 'ak_安装向导下发的密钥',
    'dat_file' => __DIR__ . '/storage/license.dat',
    'product'  => 'default',
    'claim_url'=> 'https://auth.example.com/user.html',  // 未授权时「免费领取」按钮指向
]);

<?php echo LH_Client::siteAssets(); ?>

<?php
// 放在后台设置页的某个分组下（EMLOG 模板：$options 数组的一个承载项）
echo '<link rel="stylesheet" href="auth-panel.css">'
   . '<script src="auth-panel.js" defer></script>'
   . LH_Client::boot();

<?php
// 本地判定：能解密 + 域名匹配 + 未过期（无网络请求，毫秒级）
if (!LH_Client::isLicensed()) {
    // 未授权 —— 可渲染阻断页、隐藏付费内容、或仅提示
    echo LH_Client::blockGuard();   // 输出阻断页/提示层
}

// 心跳：建议用 crontab 每小时执行一次（不阻塞页面请求）
// 0 * * * * php /path/to/站点/cron-heartbeat.php
LH_Client::heartbeat();

canonical = canonicalJson(业务参数)        # 键名递归字典序排序，紧凑 JSON，不转义斜杠/Unicode
bodyHash  = sha256_hex(canonical)
payload   = METHOD + "\n" + PATH + "\n" + timestamp + "\n" + nonce + "\n" + bodyHash
sign      = hmac_sha256_hex(app_key, payload)

# 规则：
#   METHOD    大写（"POST" / "GET"）
#   PATH      不含查询串的路径，如 "/api/license/activate"
#   timestamp Unix 秒字符串，服务端允许 ±300 秒
#   nonce     一次性随机串（长度 ≤ 64），服务端内存 + 落库双重去重防重放
#   签名失败 → HTTP 403 + code 1007

import crypto from 'node:crypto';

const SERVER  = 'https://auth.example.com';
const APP_KEY = process.env.AUTHLINK_APP_KEY;   // ak_xxx，只放服务器端

/* 1) 规范化 JSON：键名递归字典序 */
function canonicalJson(v) {
  if (Array.isArray(v)) return '[' + v.map(canonicalJson).join(',') + ']';
  if (v && typeof v === 'object') {
    return '{' + Object.keys(v).sort()
      .map(k => JSON.stringify(k) + ':' + canonicalJson(v[k])).join(',') + '}';
  }
  return JSON.stringify(v);
}

/* 2) 带签名请求 */
function signParams(method, path, params) {
  const ts = String(Math.floor(Date.now() / 1000));
  const nonce = crypto.randomBytes(16).toString('hex');
  const bodyHash = crypto.createHash('sha256').update(canonicalJson(params)).digest('hex');
  const payload = [method.toUpperCase(), path, ts, nonce, bodyHash].join('\n');
  const sign = crypto.createHmac('sha256', APP_KEY).update(payload).digest('hex');
  return { ...params, sign, timestamp: ts, nonce };
}

/* 3) 激活：换取 license_b64 */
async function activate(licenseCode, domain, clientIp = '') {
  const path = '/api/license/activate';
  const body = signParams('POST', path, {
    license_code: licenseCode,
    domain,
    client_ip: clientIp,
  });
  const res = await fetch(SERVER + path, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(body),
  });
  const json = await res.json();
  if (json.code !== 0) throw new Error(json.message);   // 业务失败 HTTP 200 + code≠0
  // 4) 解密并落盘
  const payload = decryptLicense(json.data.license_b64, domain);
  return payload;
}

/* 4) 解密 license.dat */
function deriveLicenseKey(appKey) {
  return Buffer.from(crypto.hkdfSync(
    'sha256', Buffer.from(appKey),
    Buffer.from('AuthLink.license.v1'), Buffer.from('license.dat'), 32));
}
function b64u(s) { return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64'); }
function decryptLicense(b64, domain) {
  const [ver, iv, tag, ct] = b64.split('.');
  if (ver !== 'v1') throw new Error('凭据版本不支持');
  const d = crypto.createDecipheriv('aes-256-gcm', deriveLicenseKey(APP_KEY), b64u(iv));
  d.setAuthTag(b64u(tag));
  d.setAAD(Buffer.from('license.dat|' + domain, 'utf8'));   // ★ AAD 绑定域名
  return JSON.parse(Buffer.concat([d.update(b64u(ct)), d.final()]).toString('utf8'));
}

/* 用法 */
const info = await activate('CXXX-XXXX-XXXX-XXXX', 'blog.example.com');
console.log('授权到期：', info.expire_time, '指纹：', info.fingerprint);

import base64, hashlib, hmac, json, os, secrets, time, urllib.request

SERVER  = "https://auth.example.com"
APP_KEY = os.environ["AUTHLINK_APP_KEY"]

def canonical_json(obj):
    # 键名递归字典序 + 紧凑分隔符；ensure_ascii=False 对齐 PHP 的 UNESCAPED_UNICODE
    return json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False)

def signed_params(method, path, params):
    ts    = str(int(time.time()))
    nonce = secrets.token_hex(16)
    body_hash = hashlib.sha256(canonical_json(params).encode()).hexdigest()
    payload = "\n".join([method.upper(), path, ts, nonce, body_hash])
    sign = hmac.new(APP_KEY.encode(), payload.encode(), hashlib.sha256).hexdigest()
    return {**params, "sign": sign, "timestamp": ts, "nonce": nonce}

def _post_json(path, body):
    req = urllib.request.Request(
        SERVER + path, data=json.dumps(body).encode(),
        headers={"Content-Type": "application/json"})
    with urllib.request.urlopen(req, timeout=8) as r:
        return json.loads(r.read().decode())

# ---------- 解密 license.dat ----------
def _b64u(s):
    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))

def derive_license_key(app_key: str) -> bytes:
    # HKDF-SHA256(ikm=app_key, salt="AuthLink.license.v1", info="license.dat", len=32)
    prk = hmac.new(b"AuthLink.license.v1", app_key.encode(), hashlib.sha256).digest()
    t = okm = b""; i = 1
    while len(okm) < 32:
        t = hmac.new(prk, t + b"license.dat" + bytes([i]), hashlib.sha256).digest()
        okm += t; i += 1
    return okm[:32]

def decrypt_license(b64: str, domain: str) -> dict:
    from cryptography.hazmat.primitives.ciphers.aead import AESGCM
    ver, iv_b, tag_b, ct_b = b64.split(".")
    assert ver == "v1", "凭据版本不支持"
    aes = AESGCM(derive_license_key(APP_KEY))
    plain = aes.decrypt(_b64u(iv_b), _b64u(ct_b) + _b64u(tag_b),
                        ("license.dat|" + domain).encode())
    return json.loads(plain)

# ---------- 激活 ----------
def activate(license_code: str, domain: str, client_ip: str = "") -> dict:
    path = "/api/license/activate"
    body = signed_params("POST", path, {
        "license_code": license_code, "domain": domain, "client_ip": client_ip})
    resp = _post_json(path, body)
    if resp["code"] != 0:
        raise RuntimeError(resp["message"])
    return decrypt_license(resp["data"]["license_b64"], domain)

if __name__ == "__main__":
    info = activate("CXXX-XXXX-XXXX-XXXX", "blog.example.com")
    print("已授权：", info["domain"], "到期", info["expire_time"])