Solutions

Software Licensing API for Developers

Two public endpoints — POST /validate and POST /activate — and 6 official SDKs. No API key, no OAuth, no secret to embed in a distributed binary. Just an HTTP call with the license key, POST body so it never lands in an access log.

The problem with building this yourself

Every software vendor eventually needs to answer "is this a real, currently-valid license key." Rolling that yourself means a database schema, a hashing scheme that doesn't leak plaintext keys if the DB is stolen, race-condition-safe activation counting, rate limiting so the endpoint can't be brute-forced, and — if you ever sell direct — a checkout flow. Most of that is undifferentiated work that has nothing to do with the software you're actually trying to sell.

How it works

License keys are generated client-side and encrypted with AES-256-GCM before they ever reach the server — PermitCore stores ciphertext it structurally cannot decrypt. Validation and activation each receive the plaintext key transiently (that's how a stateless HTTP API works) but never store, log, or persist it — the server computes an HMAC-SHA256 hash and looks that up. A stolen database dump can't be used to forge or read license keys. 

curl -X POST https://your-domain.com/api/v1/validate \
  -H "Content-Type: application/json" \
  -d '{"licenseKey":"PERMIT-A3K7-MN2P-QR9X-TZ5W"}'

# Response
{ "isValid": true, "productName": "Acme Video Editor Pro", "expiresAt": null }

Activation works the same shape, plus a nonce (GET /nonce first) and it atomically increments the license's activation counter — PostgreSQL row-level locking means two simultaneous activation calls for a seat-limited key can't both win the last seat. See the full API reference for every endpoint, error code, and language example.

What you get beyond the two endpoints

6 official SDKs
.NET, Node.js, Python, Java, C++, and PHP — each wraps the two endpoints with retry logic, timeout handling, and idiomatic error types, so you're not hand-rolling HTTP calls.
Offline & grace-period support
Signed offline activation tokens for air-gapped machines, plus an SDK-side cached grace period so a brief network outage doesn't lock out a legitimate customer.
Built-in abuse protection
Per-IP and per-tenant rate limiting, plus anomaly detection that catches a single valid key being shared across many distinct IPs — not just brute-force guessing.
Feature flags per license
Store a JSON feature map on each license and read which modules are enabled at validation time — upsell without shipping new keys.

Start validating license keys today

Free tier available. No credit card required.