Offline Software Licensing
For customers on air-gapped machines, secure facilities, or anywhere internet access can't be assumed at every launch. A signed offline token is verified entirely on the device — no network call, no dependency on your license server being reachable.
Who this is for
If any meaningful share of your customers run your software on machines with no internet access — defense, industrial control systems, secure government facilities, on-prem enterprise deployments behind a strict firewall — a validate-on-every-launch API call simply doesn't work. Offline activation is the answer: issue a token once, verify it locally forever.
How it works
- Customer generates a hardware fingerprint and sends it to you (email, support portal)
- You generate a signed token for that specific device from the PermitCore admin panel
- Customer's app calls
ActivateOffline(token)— the SDK verifies the signature and stores it locally - Every subsequent launch verifies the cached token offline — no internet needed, ever again
Tokens are signed with ECDSA P-256 / SHA-256, IEEE
P1363 raw signature format, over the UTF-8 bytes of a base64url-encoded JSON payload
(pc_offline_v1.<payload>.<signature>). All 6 SDKs
implement this identically — verified against a shared, versioned set of cryptographic test
vectors, not just each SDK's own hand-rolled tests.
What's verified, and how
| Property | How it's achieved |
|---|---|
| Tamper-proof | ECDSA P-256 signature — any modification invalidates it |
| Device-bound | Payload includes the device ID — SDK rejects tokens for other machines |
| Time-limited | expiresAt checked by both the SDK and an optional server verify endpoint |
| Revocable when online | Token ID tracked server-side — a machine that regains connectivity can check revocation |
Ship offline activation without writing crypto
Included from the Professional plan. Free tier available for evaluation.