Skip to content

Software Licenses Manager API - Overview

This API adds license codes to any software (desktop app, plugin, add-on, web service, game). It lets publishers create licenses, activate them on a device, deactivate, and administer everything easily — for their own product, isolated from every other publisher on the platform.

Technology & authorship
- Built in Python with FastAPI and PostgreSQL.
- Designed and maintained by XP-Flightdeck.

Three actors, not two

  • Platform (us) — provisions publisher accounts, each with its own X-Client-Token / X-Admin-Token, generated once and never stored in clear.
  • Publisher (game studio, SaaS, software vendor) — integrates the API into their own product, manages their own licenses via /admin/*. One publisher's admin token can never see another publisher's data.
  • End user — the publisher's own customer. They never talk to this API directly: they receive a license key from the publisher and type it into the publisher's software, which calls /activate on their behalf.

Who's it for, in priority order: 1. Game publishers (games, plugins, DLC, mods, assets) 2. SaaS publishers (web apps & cloud services) 3. Software publishers (desktop & on-premise)

What it’s for

  • Protect premium features: only end users with a valid license can unlock them.
  • Per-device limits: a publisher decides how many machines one of their user's licenses can run on.
  • Pause / resume: temporarily disable a license and turn it back on later.
  • Visibility: list licenses, see active devices, and key dates — scoped to your own publisher account.
  • Security: activation responses are digitally signed (Ed25519, rotatable) to prevent tampering; /activate is rate-limited per end user, not just per publisher.

Capabilities

0) Publisher provisioning (Platform)

The platform operator creates a publisher account, which receives a client_token and admin_token once. Everything below is scoped to that publisher.

1) License creation (Admin)

Generate unique keys with attributes (product/edition, activation quota per end user, feature flags).
Great for onboarding, bundles, trials, and replacements.

2) App-side activation

On first run, the publisher's app sends its end user's email, license key, and a device identifier.
The API validates and returns a signed token the app can keep as proof.

3) Device deactivation

When the end user changes machine, free a device slot to reuse the license elsewhere.
Can be triggered by the app or an admin.

4) Admin management & reporting

Search and list licenses (email, product, edition, status), paginated.
See active devices and activation history for support/compliance — and an append-only audit log of every admin action.

5) Enable / disable a license

Temporarily suspend a license (refund, abuse) or re-enable it.
Effect is immediate—no device changes needed.

6) Service health & key verification

A health endpoint confirms the API is responding. GET /public-keys exposes every signing key (active + retired) so tokens keep verifying across a key rotation.

Typical scenarios

  • Desktop app / plugin with “Pro” features.
  • Subscriptions with a limited number of devices (e.g., 2 machines).
  • Trials (time-limited + activation quota).

Functionalities Integration

  1. Get provisioned as a publisher (platform operator creates your account).
  2. Create a license for your end user (admin tool or script).
  3. Activate on first run of your app.
  4. Store the signed token in the app.
  5. Deactivate the old device when your end user migrates.

Technical details (examples, formats) live in the Quick Guide and API Reference pages.