Key posted publicly
- →Fifty machines try it.
- →Device cap refuses the rest.
- →Revoke; sessions die instantly.
Licensing API
Licensing you can
actually verify.
Signed responses. A tamper-evident log. Proof, not promises.
No card. Free tier stays free.
Every reply signed. Every action chained.
Setup
Live in three steps.
01
Sign in
Discord. No card, no sales call.
02
Create an app
It gets its own signing identity. Copy two values.
03
Drop in the SDK
C++17, vendored crypto, no runtime deps.
C++ ships today, on MinGW-w64 and MSVC. Other languages aren't written yet.
Security
A stolen database is worth nothing.
Signed responses
Ed25519, checked before parsing. A rewritten reply fails.
Nothing reusable at rest
Peppered HMACs, pepper outside the database. A dump is digests.
Binding that survives a swap
K-of-N matching. New disk still works. New machine doesn't.
Tamper-evident log
Each entry hashes the last. Edit one and the chain breaks.
Files resealed per session
Encrypted under that session's key, so a copy from one machine won't open on another. Nothing to patch: the bytes aren't there until we send them.
Threat model
What happens when.
Hardware spoofed
- →One component faked.
- →K-of-N still matches.
- →Bans are per part, so they stick.
Clock rolled back
- →System time set to last year.
- →Expiry is ours, not theirs.
- →Refused anyway.
What this isn't
Not an obfuscator. We can't stop someone editing your binary, only make sure the valuable parts live here. Pair it with a packer if you need one.
Pricing
Every tier gets every security feature.
Paying raises your limits, never your protection.
Most popular
Developer
$2/mo
$24 billed yearly · or $2.99 monthly
- ✓Unlimited applications
- ✓10,000 licences
- ✓Server-side variables
- ✓Webhooks
Seller
$3.25/mo
$39 billed yearly · or $4.99 monthly
- ✓Everything in Developer
- ✓Unlimited licences
- ✓Encrypted file gating
- ✓Admin API
Rather run it yourself? The server is open, so you can read what we do with your data.
FAQ
Fair questions.
Can't they just patch the check?
Only if it returns a boolean. Ours doesn't. A failed redeem yields no session, and gated files stay encrypted server-side.
What if you go down?
New sessions fail; existing ones run to expiry. That's the honest cost of server-side validation.
Why trust you?
Don't. Verify the signatures and read the audit chain. That's the point.
Is it production ready?
Built and adversarially tested. New, and not yet third-party audited. Judge the code.