SPDX license identifier lookup
Type an SPDX identifier and get the license behind it in plain words: Apache-2.0 is the Apache License 2.0, which allows commercial use, modification, distribution and private use, with notice and patent conditions. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Identifier
- Apache-2.0
- Full name
- Apache License 2.0
The SPDX license identifier lookup turns a compact identifier such as MIT, Apache-2.0, or GPL-3.0-only into a readable license name and a concise explanation of its central permissions and conditions. It is designed for developers, dependency reviewers, and build systems that encounter identifiers in package manifests, software bills of materials, and repository metadata. The result is deterministic and immediate: no network request, package download, or fuzzy guess is involved. If the supplied identifier is not in the supported registry, the tool returns a clear input error instead of inventing a likely match.
Read an SPDX identifier without decoding it from memory
SPDX identifiers are compact by design, which makes them convenient in machine-readable files but less helpful during a review. For example, Apache-2.0 permits commercial use, private use, modification, and distribution, while its summary also calls attention to notices, significant-change statements, and patent terms. MIT emphasizes broad reuse with preservation of its copyright and permission notice.
Copyleft entries explain the corresponding-source and licensing conditions that matter when modified code is distributed. The text is deliberately concise, so it works well in a dependency table or review screen. It is an orientation aid rather than a substitute for reading the complete license text or obtaining legal advice about a specific distribution model.
Canonical spelling, compatibility identifiers, and errors
The lookup trims surrounding whitespace and compares identifier spelling without case sensitivity, so a value copied from a loosely formatted report can still resolve to the canonical form. It does not perform fuzzy matching, guess missing punctuation, or silently choose among license versions. Those restrictions prevent a typo from becoming a confident but incorrect licensing statement.
Current versioned identifiers such as GPL-3.0-only and GPL-3.0-or-later remain distinct because the choice between one version and later versions changes the permission granted by the licensor. For compatibility with older metadata and the examples developers still encounter, deprecated short forms including GPL-3.0 are mapped to their historical “only” meaning and returned as GPL-3.0-only.
If an identifier is rejected, check it against the SPDX License List and then submit the exact identifier; the tool never treats a license title or a custom LicenseRef value as if it were a recognized standard identifier.
What you can do with it
Review a dependency manifest
Expand terse license fields into readable names and summaries before approving a new package for a project.
Enrich an SBOM interface
Show concise permissions and conditions beside identifiers in a software bill of materials without making a network request.
Validate imported metadata
Reject unsupported or misspelled identifiers explicitly so questionable licensing data enters a human review queue.
FAQ
Does this accept a full SPDX license expression?
No. Submit one license identifier. Expressions using AND, OR, WITH, or parentheses are outside this capability.
Why does GPL-3.0 return GPL-3.0-only?
GPL-3.0 is an older deprecated SPDX form whose historical meaning is the version-3-only license. The canonical result makes that meaning explicit.
Is the summary legal advice?
No. It is a short technical orientation to common permissions and conditions. Read the complete license and consult qualified counsel for legal decisions.
Does capitalization matter when I type an identifier?
No. Spaces around the identifier are trimmed and the spelling is compared without regard to case, so a value copied from a messy report still resolves, and you get the canonical form back, such as Apache-2.0.
What is the difference between GPL-3.0-only and GPL-3.0-or-later?
The first grants the license under version 3 alone; the second also lets you use later versions. Because that choice changes the permission the licensor gives, the lookup keeps the two identifiers apart instead of merging them.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/dev/license-spdx-lookup \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"identifier":"Apache-2.0"}'const res = await fetch("https://api.kit.forhosting.com/dev/license-spdx-lookup", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"identifier": "Apache-2.0"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/dev/license-spdx-lookup",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"identifier": "Apache-2.0"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/license-spdx-lookup", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"identifier":"Apache-2.0"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"identifier":"Apache-2.0"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/license-spdx-lookup", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"identifier": "Apache-2.0"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "dev.license_spdx_lookup",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_chars | 100 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Read an SPDX identifier without decoding it from memory
Enter one identifier in the identifier field and the lookup returns three stable fields: identifier, full_name, and summary. The identifier in the response uses the canonical spelling supported by this capability, full_name expands it into the commonly published license name, and summary describes the main permissions and obligations in plain English.
Canonical spelling, compatibility identifiers, and errors
An empty value, a non-string value, an identifier longer than the declared limit, or a name outside the embedded registry produces an invalid_input error.
Use the result in reviews and automation
A typical workflow extracts the license field from package metadata or an SBOM, sends each distinct value to this lookup, and displays the returned name and summary beside the dependency. That gives reviewers enough context to separate permissive licenses from file-level or strong copyleft licenses before opening the full legal text. Cache the response by canonical identifier if your pipeline handles repeated values, although the operation itself is a small in-memory lookup. The deterministic JSON shape is also useful for command-line scripts, pull-request checks, inventory dashboards, and import validation. Treat an invalid_input response as a request for human attention rather than automatically replacing the identifier: the package may use a compound SPDX expression, a custom LicenseRef, or metadata that needs correction. This capability accepts one license identifier, not a full expression containing AND, OR, WITH, or parentheses. It summarizes key permissions and conditions but does not decide whether two licenses are compatible, whether a notice file is complete, or whether a particular commercial distribution complies with the license.
Technical questions
What happens for an unknown identifier?
The request fails with an invalid_input error that includes the unrecognized value; the lookup does not guess a replacement.
How much does an API lookup cost?
Each successful API request costs $0.002. The browser version can run locally without a network lookup.