A complete, hosted license system for the software you sell. Generate keys, lock them to the machines you allow, gate features by plan, and revoke leaks in one click — issued from a panel and a Discord bot, verified from your app in any language.
Create keys and hand them out, lock each one to the machines you allow, verify them from your app without getting spoofed, unlock features by tier, and revoke the ones that leak — all from a single panel and a Discord bot. We build it, host it and keep it online; you integrate once.
If it makes an HTTPS request, it can check a license. Some of what people ship on it:
Sold on BuiltByBit, Polymart or straight from your Discord. Lock each purchase to the buyer's server, let them pull their own key with /mylicenses, and cut off resellers the moment a key leaks.
A C#, Electron or Java app running on a customer's own machine. Fingerprint the device, cap it to the seats they bought, and hide Pro features behind a tier — with no license server of your own to keep online.
Gate your own service by plan. Read featureFlags on each request to flip export, API access or seat counts on and off, and move a customer between tiers without shipping a deploy.
Selling from your own site or Gumroad? Drop in a few lines, embed one public key, and every copy checks in — perpetual or subscription, whichever you sell.
The validation endpoint, the panel and the Discord bot all run on our infrastructure — nothing to deploy, no database to back up, no 3 a.m. page when a license server falls over. You issue keys and ship your software; keeping the check online at scale is our problem, not yours.
Sell one seat and it stays one seat. Cap a key to a set number of machines with an IP limit on each, tied to a device fingerprint you compute. Spin it up on a box you didn't authorise and the check comes back SERVER_CAP_EXCEEDED — no shared key quietly running across a whole network.
valid: true · tier: PREMIUM
Cracking a license usually means patching the “yes” into the response. Here every answer is signed with your tenant's private key and verified against a public key baked into your build. Intercept the traffic, flip valid to true, and the signature stops matching — so your app throws it out. The answer is only ever as good as its signature.
Ship one binary and decide what each customer gets at check time. Define tiers and feature flags and your app unlocks exactly what they paid for — upsell without a re-release. When a key turns up on a leak site, blacklist the key, IP, machine or customer, and its next validation anywhere comes back denied.
Sell both from the same system. Time-box a key and the day it lapses it validates as EXPIRED; renewals just push the date forward — no new build, no re-ship.
Buyers look up, transfer and reset their own keys from the panel or straight from Discord. You stop being the help desk for every lost or misplaced key.
Every request carries a one-time nonce and a timestamp. Record a valid response and fire it forever? It's rejected as NONCE_REPLAY, and abusive callers get throttled.
On the JVM, drop in the zero-dependency SDK — it makes the call and checks the signature for you. Anywhere else, hit the same documented endpoint with your standard library: send the key, verify the signature, act on the verdict. That's the whole integration.
01LicenseResult r = client.validate(key, ServerFingerprint.derive());02 03if (!r.valid()) // false unless the signature verified too04 return lockOut(r.reason());05 06if ("PREMIUM".equals(r.tier()))07 enablePremiumFeatures();01const res = await fetch(url, {02 method: "POST",03 headers: { "Content-Type": "application/json" },04 body: JSON.stringify({ licenseKey: key, productCode: "MY_APP",05 serverId, nonce: crypto.randomUUID(), timestamp: Date.now() }),06});07const body = Buffer.from(await res.arrayBuffer()); // exact bytes08 09const ok = crypto.createVerify("RSA-SHA256").update(body)10 .verify(PUBLIC_KEY_PEM, res.headers.get("X-Signature"), "base64");11if (!ok || !JSON.parse(body).valid) return lockOut();01res = urlopen(Request(url, json.dumps({02 "licenseKey": key, "productCode": "MY_APP", "serverId": server_id,03 "nonce": str(uuid4()), "timestamp": int(time() * 1000),04}).encode(), {"Content-Type": "application/json"}))05raw, sig = res.read(), res.headers["X-Signature"] # exact bytes06 07pub.verify(b64decode(sig), raw, padding.PKCS1v15(), SHA256())08if not json.loads(raw)["valid"]:09 lock_out()Java drops in the zero-dependency SDK — it makes the call and verifies the signature for you. Any other language calls the same endpoint and verifies the response itself.
01{02 "valid": true,03 "tier": "PREMIUM",04 "expiresAt": "2027-01-01T00:00:00Z",05 "featureFlags": { "export": true, "api": true },06 "nonce": "3f2a9c1e-..."07}Signed validation, server-locking, tiers, blacklisting, the panel and the bot — all of it, on every plan. You're only paying for scale: how many keys and products you need. Monthly, cancel anytime.