What Is a Node-Locked License?
A node-locked license binds permitted use to identified devices. The application presents a device identifier during activation, and the licensing service records whether that device may use the key. A license can allow one or several devices; node locking does not necessarily mean a single installation.
Activation is a device decision
A successful validation says that the key meets the checked conditions. Activation also registers a device and applies the license activation rules. If you need device enforcement, do not replace activation with a simple validity lookup. Configure the allowed device count and test both an already-known device and a genuinely new one at the limit.
A device identifier is an identifier, not a secret
Hardware fingerprints can change after repairs, operating-system reinstalls or virtual-machine migration. Some components can also be copied or spoofed. Choose a stable identifier policy, explain the limits to customers and provide a supported transfer process. A hash of a weak or unstable input does not make the input reliable or turn it into proof of possession.
Make legitimate transfers possible
A customer replacing a laptop needs a clear way to release the old device and activate the new one. PermitCore device-removal flows retain the configured account and OTP protections. Do not ship an administrator API key inside the application to bypass those checks. Distinguish customer self-service from privileged support operations and retain the audit trail.
Offline use needs separate evidence
A device association by itself is not an offline signature. Verify signed offline proof using the expected public key and honor the bound device and deadline. Changing the online record cannot instantly change proof already issued to a disconnected client. Plan expiry and renewal behavior so the system remains predictable when the customer cannot reach the service.
Common questions
Can a node-locked key cover two computers?
Yes, if its configured activation limit and product policy permit two devices. The identifier binding and the allowed device count are separate settings.
Is a MAC address enough?
A network address can change, be virtualized or be spoofed. Evaluate the complete fingerprint and transfer policy rather than treating one hardware field as permanent identity.
Is node locking impossible to bypass?
No. Code running on a customer-controlled device can be modified. Device checks are one control, not a guarantee against client tampering.