Skip to content
Waveform Licensing

Core concepts

Read this page once. Everything else builds on it.

A license is one record

Section titled “A license is one record”

When a customer buys, the merchant’s store mints a license. It has two faces:

  1. The activation key. The short string the customer receives and types into your software, for example ACME-7F3K-9QPD-2MXR. Its format is cosmetic and chosen by the merchant. The key is the only credential your software handles; there are no API secrets in the client.
  2. What gates your software. This depends on the product’s enforcement mode.

Two enforcement modes

Section titled “Two enforcement modes”

The merchant picks the mode per product. You integrate the mode that matches your product; most teams need only one.

Mode Best for How it gates What it powers
Offline-capable Plugins, desktop apps A signed token, verified locally on every launch, renewed online on a lease (30 days by default) Device limits, demos, offline grace
Online (always) Web apps, SaaS, APIs, online games A real-time POST /v1/validate on each use Instant revocation, concurrent sessions, usage metering

Device fingerprints

Section titled “Device fingerprints”

Offline products bind a license to a machine with a fingerprint that your software computes:

fingerprint = base64url( HMAC-SHA256( key = appSalt, message = lowercase(trim(rawMachineId)) ) )
  • appSalt is a constant you compile into your build, unique per product. Never change it after release: doing so invalidates every existing activation.
  • rawMachineId is a stable per-OS identifier: the Windows MachineGuid, the macOS IOPlatformUUID, or the Linux /etc/machine-id. The raw ID never leaves the device; only the salted hash is sent.

Online products identify a session with an instanceId you choose (a session ID, a device ID, or userId:deviceId), which controls whether a concurrent login counts as a new seat.

Security model

Section titled “Security model”
  • The signing key never leaves the server. Clients embed only the public key. Offline tokens are Ed25519 signatures and cannot be forged without the private key.
  • Offline verification is inherently crackable. Anyone can patch a binary. The durable protections are on the server: device and session caps, short leases that must be renewed, and instant revocation for online products. See Hardening for how to raise the cost of attacking the client.
  • Online products have no offline branch to patch. Every check reaches the server, so revocation is immediate.
  • Keys are credentials. They travel in request bodies, so the API is HTTPS-only and the SDKs refuse to send a key over cleartext (loopback excepted for local development).
Section titled “What to read next”