Keyright
Software licensing for your app
Start here
Overview
What Keyright is, how Keyright Cloud and self-hosted differ, and a map of this handbook — an issuing service plus native SDKs for offline license files and online activation.
Getting started
The end-to-end vendor path for both Keyright Cloud and self-hosted — get an issuing service, create a product and signing key, put the SDK in your app, issue a license, verify it in-app, and go live.
Security & the lease model
How Keyright licenses are secured: what a key actually is, why a single-seat license cannot run on two machines even offline, what "tamper-proof" really means, and exactly how the short-lived signed lease works — renewal, going offline, and why editing a lease file cannot extend it.
Use cases
Offer a free trial
Let customers self-serve a time-limited trial key from your own site — Keyright mints it, emails it, and your app activates it exactly like a paid key — or hand an air-gapped evaluator a signed offline trial file.
Activate, deactivate & move seats
Bind a key to a machine, free that seat so the customer can move to a new one, and do it for trial, annual and perpetual licenses — online, offline/air-gapped, or vendor-side when a machine is gone — with exactly what your app sees in each case.
Gate features & editions
Unlock Pro-only and per-edition features straight from the signed license: define entitlements on a tier, read them offline with the SDK, and change what a customer gets without shipping new code.
Sell upgrades & control versions
Decide which releases of your product each license covers — lifetime updates, a support window, one major version, upgrade protection, subscriptions with or without a perpetual fallback — and enforce it in your app or on your own download page, with no reactivation, no key re-entry, and full offline support.
Meter usage & sell credits
Sell consumption on top of licensing — renders, API calls, AI generations, exports — with Keyright credit pools bound to a license: price each action, fund a pool, then check balances and spend credits from your app with dry-run pricing and idempotent retries, online or from a signed offline block.
Auto-issue keys from a store
Wire a store or Merchant-of-Record to Keyright so a paid order mints a license key and emails it to the buyer automatically — with HMAC-verified events, idempotent retries, and refund-driven revocation.
Revoke, renew & handle expiry
Cut off access, extend a term without a new key, and know exactly what the app sees at expiry, during grace, and after revocation — plus how that differs from a self-hosted instance licensing itself.
Support offline & air-gapped customers
License machines with no internet: standalone offline license files, long-lived air-gapped leases, importing a signed coverage block by file, and when to choose offline over online activation.
SDK integration
.NET SDK integration
A complete, zero-to-licensed walkthrough: create a product in Keyright, embed your public key with Keyright.NET, gate features offline, activate online, and issue keys to customers — failing closed by design.
Node.js SDK integration
Add Keyright licensing to a Node.js app: install the keyright package, verify licenses offline, activate online, gate features on entitlements, and handle trials and air-gapped machines — failing closed by design.
Python SDK integration
Add Keyright licensing to a Python app: install the keyright package, verify licenses offline, activate online, gate features on entitlements, and handle trials and air-gapped machines — failing closed by design.
Java SDK integration
Add Keyright licensing to a Java app: add the com.delta1labs:keyright dependency, verify licenses offline, activate online, gate features on entitlements, and handle trials and air-gapped machines — failing closed by design.
Use the HTTP API directly (any language)
No SDK for your language? Call the Keyright runtime API over HTTP: activate a machine, verify the signed lease offline yourself (canonical payload + RSA/SHA-256), deactivate, and handle air-gapped machines — with copyable examples you can port to Go, Rust, C++, PHP and more.
Self-hosting
Self-hosting Keyright
Run Keyright in your own infrastructure — Docker, Kubernetes or Windows/IIS, against your own PostgreSQL, fully air-gapped if you need it. This overview covers the architecture and the two moving parts; the rest of the Self-hosting section walks you through deployment, configuration, licensing, wiring your product, and operations.
Community Edition
Run real Keyright licensing free as the single-node Community Edition — up to 100 active licenses and 1 product with online activation — then upgrade the same instance in place to lift the caps and add offline/air-gapped activation, SSO, white-label and more nodes.
Deployment guide (step by step)
A step-by-step walkthrough to deploy self-hosted Keyright into your own environment: prerequisites, get the deploy kit, generate secrets, prepare PostgreSQL, choose a deploy path (Docker Compose, Kubernetes/Helm, or Windows/IIS), install your license, verify, and sign in — from zero to a running, licensed instance.
Configuration reference
Every self-hosted Keyright setting: the full environment-variable reference, how to generate the secrets, database setup and connection strings, white-labeling the dashboard and portal, and the Kubernetes/Helm values you will actually set.
Licensing & editions
How a self-hosted Keyright instance licenses itself: the fail-closed model, the 30-day Enterprise trial, the full key-state lifecycle (trial vs paid, grace windows, what happens at expiry), the Standard, Pro and Enterprise editions, and how to install or renew your key.
Wire your product to your instance
Make self-hosting real: point your customers' apps at your own Keyright instance. Create a product, generate its signing key, embed the public key and your base URL in the SDK, issue a license, and activate — the same SDKs as managed Keyright, just your product key and your URL.
Operations & troubleshooting
Run self-hosted Keyright in production: scheduled jobs, observability, security hardening, scaling and load balancing, backup and restore, upgrades, fully air-gapped operation, and a troubleshooting/FAQ for the things that come up on a first deploy.
Reference
HTTP API reference
A readable map of the issuing service HTTP API, grouped by area — Runtime, Admin, Platform, Auth, Plans, Webhooks — with method, path, and how each is authenticated.
Release notes
What changed in each Keyright release — the issuing service and the .NET, Node.js, Python and Java SDKs.
Dashboard quick reference
Where to do each task in the web dashboard — a reference index, not a screen-by-screen tour.