Getting Started

What you are building

PermitCore manages software license keys. You create a product and a license; your application asks the API whether the key is valid and decides which product features to unlock.

The hosted API base is https://api.permitcore.dev. The admin panel is https://app.permitcore.dev. Use your own API origin for a self-hosted deployment. SDK constructors take the origin without /api/v1.

Before you begin

Register a company account and verify your email.
Keep a password manager ready for your license encryption passphrase.
Choose an SDK or use the HTTP example below.

Your account password signs you in. Your license passphrase encrypts and reveals license keys. They serve different purposes and should be stored separately.

Create and check your first license

1. Create a product

In the admin panel, open Products → New Product. Enter a name for the software you are licensing and save it. A product organizes keys; creating a product does not activate an installation.

2. Generate a key

Open Licenses → Create License. Select the product, choose a seat limit, and optionally set an expiry. For a desktop installation, enable node locking and use a stable device ID from your SDK. Choose Test / Sandbox while developing to keep test activations out of the billing pool.

Enter an encryption passphrase of at least 16 characters and save it securely. After creation, reveal/copy the key with that passphrase. Configure passphrase recovery under Settings → Security before issuing production keys.

3. Validate the key

Replace the sample key below with the key you just created. Validation does not consume an activation seat. No admin API key or bearer token is required.

cURL

curl -X POST https://api.permitcore.dev/api/v1/validate \
  -H "Content-Type: application/json" \
  -d '{"licenseKey":"PERMIT-XXXX-XXXX-XXXX-XXXX","version":"1.0.0"}'

Example response

{
  "isValid": true,
  "productName": "My desktop app",
  "remainingActivations": 1,
  "expiresAt": null,
  "errorCode": null
}

HTTP 200 alone does not grant access. Require isValid: true and check that the response grants the product and features your application expects. If rejected, read message and errorCode; see troubleshooting.

4. Activate each new installation

Call your SDK's activation method once when registering the installation. The SDK obtains the required nonce. With raw HTTP, first call GET /api/v1/nonce, then include that fresh nonce in POST /api/v1/activate together with the key and device ID. See the complete activation request.

On later launches, call validation. A local “activated” flag helps avoid repeated registration; it is not proof that a license is still valid. Node-locked reactivation with the same device ID does not use another seat or monthly pool entry. Count-based activation increments on every successful call.

5. Test the important outcomes

A valid key unlocks only the intended product and features.
A revoked or expired test key is rejected.
A full seat limit produces a clear recovery message.
A network failure does not automatically unlock your app.
If you need offline access, test signed-token caching and expiry before release.

Next: sell through a Store

Connect your vendor Stripe credentials, create a store product linked to your software product, and configure the webhook before testing checkout. Keys issued by the Store use a server-side delivery workflow. Follow the Store setup guide.

Next: work with resellers

On Enterprise, assign partner accounts access to specific products and issuance caps. Creating a key does not itself consume the activation pool; qualifying activations do. See reseller management.

Next: configure payments

Customer purchases use your vendor Stripe account. Your own PermitCore subscription is managed separately in Billing. For usage charges, configure event pricing and customer mappings under metered billing.

Next: secure the account

Enable MFA, configure recovery, and assign custom roles before inviting teammates. Read the security guide for the differences between browser-created keys, Store-issued keys, and optional escrow.

Next: plan for disconnection

Choose between temporary signed offline grace and admin-issued offline activation tokens. Both have validity limits. See offline licensing and business continuity.

Next SDK Overview