The SDK is the client half of QuantumLock (the published wheel contains no server code). It provides four classes:

QuantumLockClient

A thin, synchronous client over the REST API. Auth is the X-API-Key header, set for you.
The client’s quantum_encrypt / quantum_decrypt / quantum_sign / quantum_verify helpers target the /api/v1/quantum/crypto/* endpoints, which are disabled and answer 501. Use the KMS API (POST /api/v2/kms/sign, /verify) for signing — see Key Management.

LicenseValidator (v1, deprecated)

Validates a v1 license file locally (expiry + signature integrity), with optional online cross-check. Emits a DeprecationWarning — use LicenseValidatorV2 for new integrations.

LicenseValidatorV2

Enterprise validation of v2 license artifacts. Checks run in a fixed order: signatures (RSA-PSS + optional ML-DSA hybrid), timestamps (nbf/exp/grace), device binding, revocation, and the anti-rollback epoch. ML-DSA verification requires the [pqc] extra; require_pqc=True makes a missing or failing PQC signature fatal.
Offline use with cached status proofs:
One-liner for the common case (offline, single RSA public key):

HybridLicenseValidator

Offline-first: your product starts immediately on the local check, while revocation syncs online in the background through the unauthenticated hybrid endpoint (no API key ships with your app). Configuration comes from constructor arguments or QUANTUMLOCK_* environment variables.
Environment variables read by HybridConfig.from_env():
There is no TypeScript SDK. Non-Python integrations should call the REST API directly.