Keyright · Features
Everything you need to license your software
Keyright is the whole licensing stack — offline files and online activation, seats, entitlements, usage-based metering, revocation, trials and a customer portal — available managed or self-hosted. Here’s what each capability does, why it matters, and where to learn more.
The license lifecycle
One flow, from sale to renewal
Licensing & keys
Activation & seats
Entitlements & metering
Portal, team & growth
Licensing & keys
The cryptographic core: signed licenses you can verify anywhere, signing keys isolated per tenant, and revocation that reaches even air-gapped apps.
Verify air-gapped
Signed offline license files
Keyright issues cryptographically signed license files carrying the entitlements and expiry. Your app verifies the signature locally against the public key you embed at build time — no network call, so it works on fully air-gapped machines. The public key ships in your binary and is not a secret: it can only verify signatures, never mint them.
See the SDK walkthroughYour keys, isolated
Per-tenant RSA signing keys
Every account gets its own isolated RSA key pair, generated when the tenant is created — your signatures never share a key with anyone else. The private key never leaves the server and is stored AES-256-GCM–encrypted under the service KEK. You only ever handle the public half. Key rotation is supported: ship the new public key alongside the outgoing one and both keep validating through the transition.
Read the overviewKill a leaked key
Instant revocation
Revoke a leaked or refunded key in one click (or POST /admin/licenses/{id}/revoke). Because the SDKs fail closed, the client drops to the Free edition on its next lease refresh. For purely offline apps you can also ship a signed revocation list with your build, so even an app that never phones home still honours revocations.
Activation & seats
Turn a key into a node-locked seat, count activations on the server, and keep users working through a brief outage.
Node-locked leases
Online activation with offline grace
When a customer enters a key, the SDK posts it plus a stable machine id to your service, which consumes a seat and returns a short-lived, signed lease bound to that machine. The SDK verifies the lease against your embedded public key and caches it, so the app keeps working offline until the lease’s grace window ends — a brief outage never locks a user out.
How activation worksEnforced server-side
Seat management & self-service deactivation
Seats are counted per device and enforced on the server — activating more machines than the license allows returns a seat-limit result and no lease, while re-activating a bound machine is idempotent. Drill into a license to see the machines it’s active on with device metadata, and deactivate a seat to free it when a device is gone.
See the dashboardEntitlements & metering
Ship one binary and unlock capability per plan — by feature flag, numeric limit or metered usage.
Ship one binary
Entitlements & tiers, read locally
Each tier carries a seat count and an entitlement template — named flags and numeric limits baked into every license of that tier. Ship one binary and gate features on entitlements the SDK reads locally (IsEnabled("export"), GetLimit("max-projects")), so changing a tier’s template never means shipping new code. Every check fails closed.
Sell credits, not just seats
Usage-based credit metering
Price by usage as well as by seat: define credits or tokens, monthly quotas and overage policies, and meter per action. For disconnected environments, issue signed credit blocks that a fully air-gapped machine draws down offline and reconciles when it next reconnects — so metered and air-gapped are no longer mutually exclusive.
Read the overviewLicense AI features & agents
AI & agent entitlements
Gate AI capabilities with the same signed, offline-verified licenses you already issue. Keyright defines conventional entitlement keys — ai.enabled, allow-listed ai.models / ai.endpoints / ai.tools, and an agent.budget.credits / agent.lease.seconds budget — with matching helpers on all four SDKs (license.Ai.IsModelAllowed("gpt-5"), EnforceModel(…), AgentBudgetCredits). Allow-lists support wildcards, every check fails closed, and per-agent budgets draw down through the same credit meter. There’s no new issuing API — your operator simply mints the keys.
Portal, team & growth
Everything around the license: trials that convert, a customer portal that deflects tickets, and scoped roles with a full audit trail.
No manual emails
Self-service free trials
Add a “Start free trial” button to your own site that calls POST /v1/trial directly (it’s public and CORS-open). One request mints a time-limited key and emails it to the customer — no dashboard clicks, no license files sent by hand. Trials are one per email per product (idempotent and abuse-resistant), auto-expire, are fully revocable, and convert to a paid license with no re-keying. Air-gapped evaluators can get a signed offline trial file instead.
Fewer support tickets
Hosted customer self-service portal
A hosted portal where your customers view their keys, manage seats and download offline license files themselves — no tickets to you. Keyright runs the issuing service, key storage and portal, so you don’t operate any of it.
What Keyright hosts for youSell through any store
Auto-issue keys on paid orders
Connect your checkout and let paid orders mint licenses automatically. Keyright verifies and parses webhooks from Stripe, Lemon Squeezy, Paddle and FastSpring at POST /webhooks/commerce/{provider}/{tenant} — a constant-time signature check per provider — and reads the product, tier and seat count from the order’s metadata to issue and email the key. Fulfillment is idempotent, so a retried webhook never double-issues, and it reuses your existing tenant webhook secret — no migration, no custom glue code.
Control who does what
Team RBAC & audit trail
Invite your team with scoped roles — owner, admin, support, billing and read-only viewer — so support can free seats without touching billing, and only owners manage the workspace and webhook secret. Sign-in is email + password + mandatory TOTP, or Google / GitHub OAuth on your own domain.
See roles in the dashboardBuild & deploy anywhere
SDKs for four runtimes, a .NET-first heritage, and your choice of fully managed or self-hosted — including air-gapped.
Any runtime, one tenant
SDKs for .NET, Node, Python & Java
Drop-in client SDKs verify the exact same license and lease formats across .NET, Node.js, Python and Java, so a mixed-language product line shares one Keyright tenant and one public key. The .NET SDK multi-targets netstandard2.0 and net8.0, running on .NET Framework 4.8 and .NET 6–10. License files and activation use a documented HTTP + signature format, so you can verify from any language.
Built by the same team
Wire-compatible with Nebula.NET
Keyright is built by the team behind Nebula.NET and is wire-compatible with Nebula.NET’s licensing — the same signed license and lease formats — so you get first-class .NET support and licensing that pairs naturally with obfuscated, hardened builds.
Read the overviewYour infrastructure or ours
Managed or self-hosted
Run Keyright fully managed on our cloud, or self-host the identical build inside your own network — Docker, Kubernetes (Helm) or Windows/IIS — including fully air-gapped. A self-hosted instance runs your own PostgreSQL, verifies its own licence offline with no phone-home, and keeps every piece of licensing data inside your compliance boundary. Move between managed and self-hosted without changing your integration. See self-hosted →
Explore self-hostedShip licensing this week
Add every capability above in an afternoon — managed for you, or self-hosted in your own infrastructure. No card required to start.