Electron App Licensing
Electron licensing should enforce the entitlement in the part of your application that controls valuable work. The renderer can display license state, while a trusted application process coordinates validation, activation and storage. PermitCore provides a Node.js SDK; it does not make a customer-controlled desktop process tamper-proof.
Keep the process boundary deliberate
Put licensing requests and local proof handling in the main process or another deliberately constrained service. Expose a narrow IPC interface to the renderer rather than arbitrary network or filesystem access. Never embed a PermitCore administrator API key in either process. The customer license key and the integration context are different from platform management credentials.
Choose device seats or shared sessions
Use device activation when purchases are assigned to a limited set of computers. Use the floating lifecycle when people borrow concurrent seats. A successful validation is not a floating checkout, and an active window is not evidence that a seat was granted. Keep application startup and shutdown connected to the actual lifecycle you selected.
Handle network and payment state explicitly
Use the SDK response contract, honor signed offline deadlines and distinguish unavailable transport from an explicit denial. Existing offline proof cannot be extended by a failed heartbeat or a browser payment success message. For Store sales, choose Stripe or Paddle for the whole Store and wait for verified fulfillment before presenting a newly purchased key as ready.
Test the packaged app
Exercise the packaged main/renderer boundary, refresh, offline startup, rejected responses, hardware changes and uninstall/reinstall. Test the supported operating systems and your actual Electron security settings. SDK unit tests do not certify every packaged application or runtime configuration.
Common questions
Is there a dedicated integration for this platform?
Use the documented SDK or HTTP boundary described here. Platform packaging, plugin/update distribution and framework security remain part of your application.
Can I include a management API key in the shipped code?
No. Keep management credentials on a controlled backend; distributed client code is inspectable.
Which checkout provider can my Store use?
Each vendor chooses Stripe or Paddle for the whole Store. Existing purchases keep their original connection; checkout does not automatically switch providers.