npm Package License Keys
Commercial npm package licensing has two separate meanings: the legal terms for using the code and the technical entitlement your application checks. PermitCore helps with the latter through its Node.js SDK. A package license field is not a paid entitlement, and downloading a package does not activate a customer license.
Choose what requires permission
Define the paid operation, deployment or feature before adding checks. A local package can be inspected and modified, so do not promise that obfuscation or a single startup request prevents every bypass. If the valuable operation runs on your service, enforce the entitlement there rather than trusting a result sent by an untrusted browser.
Use the correct JavaScript environment
The Node.js SDK is for the supported Node environment, not a promise that every browser bundler can include it unchanged. Keep secrets out of front-end bundles and published package files. Use a narrow backend interface when a browser needs to request a paid operation.
Keep lifecycle operations distinct
Use validation for the documented checks, activation for device registration and floating checkout/heartbeat/checkin for shared sessions. Do not automatically retry a mutating operation as if it were a harmless lookup. When shutting down, confirm checkin where the workflow needs confirmation; retain lease deadlines for crashes.
Document deployment expectations
Explain how customers supply their own license key, how many installations or sessions the plan permits and what happens offline. Test server restarts, multiple workers, rejected evidence and the package version you publish. PermitCore does not become your npm registry and does not replace the legal license or distribution controls you choose.
Common questions
Is there a dedicated integration for this platform?
Use the documented SDK or HTTP boundary described here. Platform packaging, plugin/update distribution and framework security remain part of your application.
Can I include a management API key in the shipped code?
No. Keep management credentials on a controlled backend; distributed client code is inspectable.
Which checkout provider can my Store use?
Each vendor chooses Stripe or Paddle for the whole Store. Existing purchases keep their original connection; checkout does not automatically switch providers.