Hardware-bound activation
Every activation binds the session to a device fingerprint. A leaked key stops working the moment it leaves the machine it was activated on. Device caps are enforced server-side.
Licensing infrastructure
Licenses that
Licenses that
defend themselves.
Keys get shared. Builds get cracked. Licentry is the licensing API that notices and fights back: hardware-bound activations, proof-of-possession sessions, cryptographically signed responses and per-customer watermarked builds.
P-256 SIGNED RESPONSES· DPoP RFC 9449· HOSTED OR SELF-HOSTED
# activate · device-bound · proof-of-possession
POST /v1/sess/activate
x-licentry-build: 7Q2MKR…WX94
{ "licenseKey": "aB3xK9m-7Qp2n-M4kL8z-Xy1Wq9r",
"deviceHash": "9f2c41d8…c3e1a7",
"dpopPublicJwk": "{ \"kty\":\"EC\", \"crv\":\"P-256\", … }" }
201 Created · 96 ms
X-Licentry-Sig: MEUCIQDr4… ◈ P-256 · kid rs1
{ "accessToken": "9af2…", "expiresAt": "+20m",
"offlineGraceJwt": "eyJhbGciOiJFUzI1NiI…" }
POST /heartbeat { "seq": 1 } ✓ 200 · signed
POST /heartbeat { "seq": 2 } ✓ 200 · signed
● session live · device-bound · dpop-bound · rv 3
P-256every signature channel
314-bitbuild token entropy
< 1 heartbeatrevocation propagation
5 endpointsfull client integration
Why Licentry
Most licensing checks return a boolean.
Most licensing checks return a boolean.
Crackers patch booleans.
Licentry treats licensing as a live, signed, device-bound session, not a one-shot yes/no your attacker flips in a debugger.
Proof-of-possession sessions
Short-lived access tokens can be DPoP-bound to a P-256 key held by the client. A stolen token is useless without the private key that never leaves the device.
Signed responses
Every license response carries an ECDSA P-256 signature your app verifies against pinned public keys. A spoofed server, patched DNS or MITM'd reply fails closed.
Watermarked builds
Binaries are patched per download with a unique build token, owner hint and self-hash. When a copy leaks, one query tells you exactly which account it came from.
Sharing detection
Concurrent-session caps, per-key device limits, heartbeat sequence tracking and geo evidence trails surface resellers and "family plans" you never approved.
Kill switch & canaries
A revocation bump invalidates every running session within one heartbeat. Canary keys act as honeytraps that flag cracker probing before it becomes a problem.
Integration lifecycle
Five endpoints. One afternoon.
The whole client integration is a small, strict state machine. The order below is the order your code runs in.
01
Issue
Issue vendor API
Mint 28-character license keys from your dashboard or the vendor API. Keys are HMAC-peppered at rest with a pepper unique to your account, so a database leak alone reveals nothing usable.
02
Activate
Activate POST /activate
Your app sends the key, a device hash, and optionally a DPoP public key. It gets back a short-lived session: access + refresh tokens, signed, idempotent on retry.
03
Heartbeat
Heartbeat POST /heartbeat
A monotonic sequence counter keeps the session provably alive. Replays and skipped counters are rejected, so cloned sessions surface immediately.
04
Refresh & revoke
Refresh & revoke POST /refresh
Tokens rotate before expiry. When you revoke or freeze a license, the bump invalidates every bound session on its next beat. No waiting for expiry.
// 1. activate once per install auto s = licentry.activate(key, deviceHash(), dpopJwk()); // 2. verify the response signature (pinned P-256) if (!verify(s.header("X-Licentry-Sig"), pinnedKeys)) fail_closed(); // 3. heartbeat on a timer, seq strictly increasing every(minutes(15), [&]{ licentry.heartbeat(++seq); }); // 4. refresh before expiry; re-activate on stale_revocation before(s.expiresAt, [&]{ s = licentry.refresh(s.refreshToken); }); // offline? verify the ES256 grace JWT (device-bound) if (offline && graceJwt.dev == deviceHash()) run_grace_period();
Defense in depth
Built by people who
Built by people who
watch software get cracked.
Every layer assumes the one above it eventually fails. That's the point: defense in depth means a cracked check still doesn't produce a working copy.
- Indistinguishable failures. Unknown, expired, revoked and canary keys all fail identically, on the same response schedule, so activation can't be used as an oracle to sort live keys from dead ones.
- Server-held engine parameters. Ship config your app actually needs, sealed to the live session key. Patching the license check out means the app still can't run: there's nothing to run with.
- Everything audited. Wrong-owner logins, canary hits, replayed heartbeats, HWID resets: every security-relevant event lands in an append-only audit log with actor, IP and evidence.
L7Response signingECDSA P-256
L6Proof-of-possessionDPoP · RFC 9449
L5Build watermarking.lcmrk · HMAC
L4Offline graceES256 JWT · device-bound
L3Canary keysHoneytrap
L2Timing normalizationAnti-oracle
L1Sharing evidenceAudit trail
Deployment
Run it our way. Or yours.
Licentry Cloud
We run the API, the database, the key management and the on-call. You get an endpoint, a vendor dashboard and scoped API keys. The fastest way from zero to enforced licensing.
Your infrastructure
Node + PostgreSQL, deployable on a single box. Signing keys load from encrypted credential stores or root-locked secret files, never plaintext env. Your keys never leave your hardware.
Plans
Early access. Founding rates.
Licentry is onboarding its first wave of vendors. Founding integrations lock their launch rate for life. Billing is crypto-only, no KYC.
Indie
For a first product
- Hosted licensing API
- Up to 3 products
- Device binding & session caps
- Signed responses
- Community support
Studio
For serious catalogs
- Everything in Indie
- Up to 15 products
- DPoP sessions & offline grace
- Per-vendor signing keys
- Sharing evidence & canary keys
- Priority support
Self-host
For teams that hold their own keys
- Full server license
- Deployment & secrets hardening guidance
- KeyAuth migration tooling
- Direct engineering support
CRYPTO-ONLY BILLING · NON-KYC · FOUNDING INTEGRATIONS LOCK THE LAUNCH RATE.
FAQ
Common questions
How long does integration take? +
The core loop is five endpoints: validate, activate, heartbeat, refresh, logout. A minimal integration is an afternoon; adding response-signature pinning, DPoP and offline grace is typically another day. The docs walk through every step with copy-paste examples.
Which languages and platforms are supported? +
Anything that speaks HTTPS and JSON. Every signature channel is ECDSA P-256 specifically so native Windows clients can verify with built-in BCrypt and no extra crypto dependencies. The docs include recipes for C++, C#/.NET and Node.
What actually happens when a key leaks? +
Device caps stop it activating on new machines. Concurrent-session caps stop parallel use. The sharing-evidence view shows you devices, IPs and geography per key. One click bumps the revocation version and every bound session dies on its next heartbeat. If the leak was a whole binary, its watermark tells you which account it came from.
Do licensed apps work offline? +
Yes. Activation can return a short-lived, device-bound offline-grace token (an ES256 JWT your app verifies locally). You choose the TTL, from 1 hour to 7 days. Revoked licenses run out of grace instead of running forever.
Can we self-host Licentry? +
Yes. The server is Node + PostgreSQL and runs comfortably on a single box. Private keys load from systemd encrypted credentials or root-locked secret files rather than plaintext env, and the docs cover the full production checklist.
How do payments work? +
Crypto only, no KYC. You upgrade from the dashboard and pay a hosted crypto invoice (BTCPay), or arrange a manual transfer. Your plan activates the moment the payment settles.
Get started
Ship software that
Ship software that
stays paid for.
Integrate in an afternoon. Sleep through the next crack attempt.