Licensing infrastructure for software vendors
Add licensing to your app in an afternoon. Offline license files and online activation, node-locking, seats, entitlements, usage-based metering, a customer portal and self-service trials — with SDKs for .NET, Node, Python and Java. Run it fully managed or self-hosted, including air-gapped.
Free plan · no card required · read the docs · code samples on GitHub · self-hosted & air-gapped →
// verify a license offline, against your public key
var license = Keyright.Verify(key, PublicKey);
if (license.Valid && license.Entitlements.Has("pro"))
EnablePremiumFeatures();
// …or activate online for a node-locked seat
await Keyright.ActivateAsync(key, machineId);Why Keyright
The whole licensing stack, so you build none of it
Rolling your own licensing is weeks of signing keys, activation servers, seat counting, revocation and a customer portal — none of it your product, all of it security-critical. Keyright gives you the entire stack behind a few lines of SDK, so you add licensing in an afternoon and get back to shipping.
How it works
From zero to licensed in four steps
No signing servers to run, no key management to build. Wire up the SDK once and Keyright handles the rest — the same flow whether you run it managed or self-hosted.
Create a product & tiers
Define your product, its plans and the entitlements each plan unlocks — feature flags, numeric limits, seat counts and metered credits — in the Keyright dashboard.
Embed the SDK
Add the SDK to your app and paste your account's public key. A few lines verify a license, read entitlements and activate a seat — the same code on every runtime.
Issue keys or let customers self-serve
Issue keys from the dashboard or API, sell through Merchant-of-Record checkout, or let customers start a free trial from your own site — keys mint automatically.
Customers activate & you stay in control
They activate online for a node-locked, revocable seat, or drop in a signed offline file for air-gapped machines. Revoke, move seats or meter usage at any time.
Architecture
How activation & verification flow
Your app embeds a verify-only public key. It activates online for a node-locked lease, or verifies a signed file offline — the private key never leaves the issuing service, whether that service is our managed cloud or your own self-hosted instance.
Capabilities
Everything you need to license your software
Grouped the way you'll actually use them — from the cryptographic core to the customer-facing portal and where you deploy.
Licensing & keys
A cryptographic core you can trust
Signed licenses you can verify anywhere, signing keys isolated per tenant, and revocation that reaches even air-gapped apps.
Signed offline license files
Cryptographically signed files carry the entitlements and expiry, and verify locally against a public key you embed at build time — no network call, so they work on fully air-gapped machines.
Per-tenant RSA signing keys
Every account gets its own isolated RSA key pair. The private half never leaves the server and is encrypted at rest; you only ever handle the verify-only public key. Rotation is supported.
Instant revocation
Kill a leaked or refunded key in one click. Online clients drop to the free edition on their next lease refresh; offline builds honour a signed revocation list you ship with them.
Activation & seats
Node-locked seats, enforced server-side
Turn a key into a device-bound seat, count activations on the server, and keep users working through a brief outage.
Online activation with offline grace
The SDK exchanges a key plus a stable machine id for a short-lived, signed lease bound to that device. It caches the lease and keeps working offline until the grace window ends — an outage never locks users out.
Node-locking & seat management
Bind licenses to a device fingerprint and enforce per-plan seat counts on the server. Over-activation returns a seat-limit result and no lease; re-activating a bound machine is idempotent.
Self-service deactivation
Customers free a seat when a device is retired — from the portal or an API call — without opening a ticket. Drill into any license to see the machines it is active on with device metadata.
Entitlements & metering
Ship one binary, sell it many ways
Unlock capability per plan by feature flag, numeric limit or metered usage — without shipping new code for every tier.
Entitlements & tiers
Each tier carries a signed entitlement template — named flags and numeric limits the SDK reads locally (IsEnabled("export"), GetLimit("max-projects")). Change a tier and every license of that tier follows. Every check fails closed.
Usage-based credit metering
Sell credits or tokens, not just seats: per-action pricing, monthly quotas and overage policies — plus signed credit blocks that meter fully air-gapped machines and reconcile when they reconnect.
Portal, team & sales
Everything around the license
A customer portal that deflects tickets, trials that convert, scoped roles for your team, and checkout that issues keys automatically.
Customer self-service portal
A hosted portal where your customers view keys, manage seats and download offline files themselves. Keyright runs the issuing service, key storage and portal, so you operate none of it.
Self-service free trials
One public API call mints a time-limited key from your own site — one per email per product, abuse-resistant, auto-expiring and fully revocable. It converts to a paid license with no re-keying.
Team RBAC & audit log
Invite your team with scoped owner, admin, support, billing and viewer roles, so support can free seats without touching billing. Every action lands in a full audit trail.
Merchant-of-Record checkout
Sell through a Merchant-of-Record checkout that handles sales tax, VAT, invoicing and dunning. When a payment succeeds, Keyright issues the license automatically — no manual fulfilment.
Build & deploy anywhere
Your languages, your infrastructure
SDKs for four runtimes, a .NET-first heritage, and your choice of fully managed or self-hosted — including air-gapped.
SDKs for .NET, Node, Python & Java
Drop-in clients verify the exact same license and lease formats across every runtime, so a mixed-language product line shares one tenant and one public key. Any other language can verify the documented HTTP + signature format. See runnable samples on GitHub — .NET, Node, Python, Java and a raw REST walkthrough.
.NET-first & Nebula-compatible
Built by the team behind Nebula.NET and wire-compatible with its licensing — the same signed formats — so licensing pairs naturally with obfuscated, hardened .NET builds. The .NET SDK runs on Framework 4.8 and .NET 6–10.
Managed or self-hosted
Run it fully managed on our cloud, or self-host the identical build inside your own network — Docker, Kubernetes (Helm) or Windows/IIS — including fully air-gapped. Move between them without changing your integration.
See it in action
A dashboard for the whole licensing lifecycle
Issue and manage keys, watch activations, run trials and metering, and invite your team — the same /admin/* API behind a clean UI.
Home — licenses, active seats, expiring soon and revoked, per product.
Who it's for
Built for teams who sell software
From a solo ISV shipping a desktop app to an enterprise vendor deploying on-prem — Keyright meets you where you sell and where you run.
Independent software vendors
Desktop, server and CLI products that need real licensing — signing, seats, revocation and a portal — without building and running signing infrastructure.
.NET teams
First-class .NET support and Nebula-compatible licensing that pairs with obfuscated, hardened builds, across .NET Framework 4.8 and .NET 6–10.
Usage-based & AI products
Sell credits, tokens or API calls with quotas and overage — and signed credit blocks that meter even offline and reconcile on reconnect.
Regulated & on-prem
Keep every piece of licensing data inside your compliance boundary with a self-hosted, air-gapped deployment on your own PostgreSQL.
Free trials, built in
Let customers start a trial from your own site
Add a "Start free trial" button to your marketing site and let it call Keyright directly. One request issues a time-limited key — no dashboard clicks, no license files emailed by hand.
- Keys auto-expire when the trial ends
- One per email per product — abuse-resistant and idempotent
- Fully revocable, tracked in your dashboard, and converts without re-keying
# one call from your site → key is emailed to the customer
curl -X POST https://keyright.delta1labs.com/v1/trial \
-d '{"product":"acme-app",
"email":"dev@company.com",
"company":"Acme"}'
# → { "ok": true, "emailed": true,
# "expiresUtc": "…" } # work email requiredPricing
Start free — paid plans from $49/mo
Ship real licensing on the Free plan, then upgrade as your active-license count and team grow. Every paid plan includes a 14-day free trial, and a self-hosted licence is available for on-prem and air-gapped teams.
FAQ
Questions, answered
Is there a free tier?
Yes. The Free plan is $0 forever and includes up to 25 active devices across 1 product — enough to ship real licensing before you pay a cent. No card required.
Can I self-host Keyright?
Yes. Keyright is available fully self-hosted, including air-gapped. You run the same issuing service and your own PostgreSQL inside your infrastructure — it ships as a Docker image (with a Helm chart for Kubernetes) or a Windows/IIS bundle. Your instance verifies its own licence offline, with no phone-home, and your customers are never affected by it. Self-hosting suits teams with data-residency, on-prem or air-gapped requirements — talk to sales to get set up.
Which languages and SDKs are supported?
Keyright is .NET-first, with official client SDKs for .NET, Node.js, Python and Java. License files and activation use a documented HTTP + signature format, so you can verify licenses from any language.
How do offline licenses work?
Keyright issues a signed license file containing the entitlements and expiry. Your app verifies the signature locally against the public key you embed at build time — no network call needed, so it works air-gapped. You choose an optional grace window for online re-checks.
Can I offer free trials to my customers?
Yes — self-service trials are built in. One call to /v1/trial issues a time-limited key from your own site. Trials auto-expire, are fully revocable and are tracked in your dashboard, so you never hand out license files by email.
How is billing handled?
Keyright uses a Merchant of Record for your Keyright subscription and, optionally, for your own product sales. The Merchant of Record handles sales tax/VAT, invoicing and dunning; Keyright issues the license automatically when a payment succeeds.
Ship licensing this week
Create your free account and add real licensing today — no card required. Talk to sales when you're ready for volume, SSO, white-label or a self-hosted deployment.