Licensee quickstart

Your license agreement asks you to make sure licensed products are verified through CheckMerch before manufacture. What that means for you depends on who runs the press.

Base URL: https://checkmerch.io. Contact: help@checkmerch.io.

The identifiers below (ver_..., wrk_..., grant_...) are from our demo catalog, so substitute your own. The artwork and rights holders in the examples are invented.

1. What you were given

Your licensor registered their artwork with CheckMerch and issued you a grant: a record of what your agreement permits, expressed as works, uses (print, sell, display), territory, and a term. You should have:

An API key, like mrc_..., with the verify scope. Keep it server-side. Everything on this page uses it.
A grant id, like grant_01m00f692v7t17tks8cey8fnf6. A reference you can quote on paperwork. Not a secret, and not a credential.
A grant token, a long signed string, if you verify artwork yourself. It is a credential and works only on your own key. If you do not run production, you will never need it.

If you are missing something, email help@checkmerch.io and name your licensor. There is no signup form, and there is nothing to pay: verification is free.

export CHECKMERCH_KEY=mrc_your_key_here

2. Which part of this is yours

Production-verification clauses have two halves, and most licensees only need one of them.

If printers, manufacturers, or fulfilment partners make your products, and you never touch a press yourself, your entire job is section 3: authorize them once each. They then verify every job themselves, on their own accounts. You will not be sending artwork to CheckMerch at all, and the only call you ever make is POST /v1/suppliers.

If you run production in-house, section 4 is how you verify the work you print yourself. If you also send work to outside printers, do section 3 for each of them.

3. Authorize the printers who produce for you

You authorize a supplier once. From then on they verify your jobs on their own account, and you never send them a credential of yours.

Get their account id from them, then:

curl -X POST https://checkmerch.io/v1/suppliers \
  -H "Authorization: Bearer $CHECKMERCH_KEY" \
  -H "Content-Type: application/json" \
  -d '{"supplier_account": "acct_01m00f68jy5qhffb6vj0mjf8rx", "external_ref": "VENDOR-118"}'

{
  "id": "lsl_01m00f6kgex6b10t61172r9eab",
  "supplier": { "account": "acct_01m00f68jy5qhffb6vj0mjf8rx", "name": "Harbor Print Works" },
  "external_ref": "VENDOR-118",
  "active": true,
  "started_at": "2026-08-14T15:45:40Z",
  "ended_at": null
}

That is the whole task for a licensee who does not run production. Repeat it per supplier. external_ref is optional and is for your own vendor number, so the list reconciles against your purchasing records.

From then on, that printer verifies by naming you as the ordering party. They do not need your token, your key, or a grant id per job, and nothing on their side changes when a license renews or you add a new one. The registry checks that you authorized them and looks across every license you hold.

See who you have authorized, and end one at any time:

curl https://checkmerch.io/v1/suppliers -H "Authorization: Bearer $CHECKMERCH_KEY"

curl -X DELETE https://checkmerch.io/v1/suppliers/lsl_01m00f6kgex6b10t61172r9eab \
  -H "Authorization: Bearer $CHECKMERCH_KEY"

Ending it takes effect on that printer's very next call. The authorization is closed rather than deleted, so verifications they made while it was live stay on the record and stay explicable.

Send your printers the supplier quickstart and they can take it from their side. If a printer of yours does not have a CheckMerch account yet, put them in touch with help@checkmerch.io. Verification is free for them too.

What about just sending them the grant id?

You can quote a grant id to a printer, and they can look it up and see what the license covers and that it is live. It will not turn their verdict green. A grant id travels on purchase orders and job tickets, so it identifies a license rather than establishing that the party quoting it may act on it. Authorize the printer and the same job comes back match_authorized.

Never send a printer your grant token or your API key. Those authenticate as you.

4. If you run production yourself

Only relevant if artwork gets printed on your own equipment. Verify on your own key, presenting your grant token:

curl -X POST https://checkmerch.io/v1/verify \
  -H "Authorization: Bearer $CHECKMERCH_KEY" \
  -F "image=@artwork.png" \
  -F "grant_token=$CHECKMERCH_GRANT_TOKEN" \
  -F "context[intended_use]=print" \
  -F "context[territory]=US" \
  -F "context[external_ref]=PO-2291"

{
  "id": "ver_01m00f9rzkpssxa5yr36rq8jc6",
  "verdict": "match_authorized",
  "fingerprint_version": "fp-v1",
  "matches": [
    {
      "tier": 1,
      "confidence": "exact",
      "authorized": true,
      "work": {
        "id": "wrk_01m00f68tc9zz52xe1wd58n0jv",
        "title": "Haunted Ramen",
        "holder": { "id": "rh_01m00f68jn5ez7a4wn9ddz7b6f", "name": "Aster & Vane Studio" }
      }
    }
  ],
  "grant": {
    "id": "grant_01m00f692v7t17tks8cey8fnf6",
    "valid": true,
    "revoked": false,
    "expired": false,
    "unchecked": [],
    "presented_as": "token",
    "granted_by": { "id": "rh_01m00f68jn5ez7a4wn9ddz7b6f", "name": "Aster & Vane Studio" },
    "granted_to": { "account": "acct_01m00f68jvv0mp0sd9aceg88ab", "name": "Meridian Merch Co." },
    "works_covered": ["wrk_01m00f68tc9zz52xe1wd58n0jv"],
    "authorizing": true
  },
  "created_at": "2026-08-14T15:47:24Z"
}

match_authorized is the result your agreement is asking for.

Keep the id. Your agreement most likely asks you to retain verification records and produce them on request, and the id is the record. Put your own purchase order or job number in context.external_ref so the two line up, and read it back any time:

curl https://checkmerch.io/v1/verifications/ver_01m00f9rzkpssxa5yr36rq8jc6 \
  -H "Authorization: Bearer $CHECKMERCH_KEY"

{
  "id": "ver_01m00f9rzkpssxa5yr36rq8jc6",
  "verdict": "match_authorized",
  "fingerprint_version": "fp-v1",
  "min_confidence": "high",
  "context": { "territory": "US", "external_ref": "PO-2291", "intended_use": "print" },
  "grant": { "id": "grant_01m00f692v7t17tks8cey8fnf6", "presented_as": "token" },
  "created_at": "2026-08-14T15:47:24Z"
}

Your printers keep their own records the same way, on their own accounts. If you need one of theirs, ask them for the verification id: we scope every verification to the account that made it, so you cannot read theirs and they cannot read yours.

When the answer is not `match_authorized`

Verdict	What it means for you
`match_authorized`	The grant covers this artwork for the use and territory you sent.
`match_unauthorized`	The artwork matched registered work, and the license you presented does not cover it. Check `works_covered`, and `valid`, `revoked` and `expired` on the `grant` object.
`no_match`	Nothing matched. Common and not a problem in itself: it usually means the artwork you sent is not the registered file, or your licensor has not registered this design.
`match_reference`	The artwork matches known third-party IP in our reference index, separate from your licensor's catalog. Your license with your licensor says nothing about that IP, so this is worth raising with them before production.

The most common surprise is a valid grant with an empty works_covered. That means the grant is live but does not extend to this particular design, which is a scope question for your licensor, not a technical fault.

context sharpens the check and is worth sending. Omit intended_use or territory and the grant's restrictions on them are not evaluated, which shows up honestly in the response as "unchecked": ["intended_use"]. A verification that checked less is a weaker record.

5. Check a grant without sending artwork

Useful whether or not you print: it answers "is my license live, and what does it cover" with no artwork involved.

curl -X POST https://checkmerch.io/v1/tokens/introspect \
  -H "Authorization: Bearer $CHECKMERCH_KEY" \
  -H "Content-Type: application/json" \
  -d '{"grant_id": "grant_01m00f692v7t17tks8cey8fnf6"}'

{
  "id": "grant_01m00f692v7t17tks8cey8fnf6",
  "valid": true,
  "revoked": false,
  "expired": false,
  "unchecked": ["intended_use"],
  "presented_as": "id",
  "granted_by": { "id": "rh_01m00f68jn5ez7a4wn9ddz7b6f", "name": "Aster & Vane Studio" },
  "granted_to": { "account": "acct_01m00f68jvv0mp0sd9aceg88ab", "name": "Meridian Merch Co." },
  "authorizing": false
}

Send grant_token instead of grant_id and you get the same answer with "presented_as": "token" and "authorizing": true.

There is also a status-only check that needs no key at all, if you want something simple to poll:

curl https://checkmerch.io/v1/grants/grant_01m00f692v7t17tks8cey8fnf6/status

{ "status": "active", "revoked_at": null }

6. Revocation, and work already in flight

A grant can be revoked by your licensor, and it can expire at the end of its term. Either takes effect immediately. From that moment the same file returns match_unauthorized, for you and for the printers you authorized alike, with "revoked": true or "expired": true on your own calls.

Verifications already made do not change. A match_authorized from last Tuesday is a permanent record of what was true last Tuesday, which is the point of keeping the id. What changes is every check from now on, including checks your printer runs on a job already in their queue.

So the practical question is not what happens to your past records, it is what your agreement says to do about production that is under way. Most say to pause it and talk to your licensor, and many set a notification window. Read your own clause. CheckMerch reports status; it does not decide what gets manufactured.

If a grant was revoked in error, or you have re-signed and need a new one, your licensor reissues it. We cannot do that for them.

You can be told rather than finding out on the next call. Register a webhook on your account for grant.revoked:

curl -X POST https://checkmerch.io/v1/webhooks \
  -H "Authorization: Bearer $CHECKMERCH_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://yourcompany.example/hooks/checkmerch", "events": ["grant.revoked"]}'

The response carries a secret, shown once. Deliveries are signed with it in a CheckMerch-Signature: t=<timestamp>,v1=<hmac> header, where the HMAC is SHA-256 over <timestamp>.<raw body>.

This one is worth doing even if you never print anything: it is how you learn that a license you are relying on has stopped, without having to poll.

7. Getting help

Email help@checkmerch.io with the verification id or the grant id. If a verdict does not match what you believe your license says, send us both and we will tell you what the grant covers. Questions about what your license itself permits belong with your licensor: we record the grant, we do not write it.