A product that sells licences#
Any product in CoreInto can use the Licensing Manager instead of a server. When the order is paid, the service gets a licence key with the prefix you choose, the welcome email carries it, and the client sees it on the service page. The licence follows the service: suspended when the service is suspended, active again when it is paid, and ended when the service ends.
CoreInto uses this itself. The licences for CoreInto, for the intoPanel hosting control panel and for StackRegent are all sold by CoreInto installations with the Licensing Manager.
Binding#
A key can be bound to what the licensed program reports: an IP address, a domain, a folder, a machine identifier, or any mix of them. The first check-in can fill the binding in by itself, or staff can set it. When a client moves to a new server, they reissue the licence from the service page, and the next check-in binds it again. Staff can limit how often a client may reissue.
Signed answers the program can trust#
Your program asks the check address whether its key is valid. CoreInto answers with the state, product, edition, limits, features and dates, and signs the answer with your private key (ECDSA P-256; version 2 uses JWT tokens signed with ES256). The program checks the signature with the public key it carries, so a forged licence server cannot fake an answer. Answers can be cached by the program for offline days.
Editions, trials and features#
Products carry a product code, an edition name, account limits, a list of features and trial and grace days. One installation can sell a basic edition and a professional edition of the same program, and the program reads which one it holds and what it may do.
Signed releases#
Publish new versions of your program as releases with notes and a file. Licensed installations ask for the latest release, download it and check its signature against a release key that you keep offline, so a compromised server cannot push a bad update. The tool tools/release.php signs releases on your own computer.
Public answers for your website#
Two read-only addresses, switched on in the settings, let your product website show the plans on sale and the release notes, and let anyone check whether a server holds a genuine licence. This website reads its pricing and release notes from them.
Logs and the API#
Every check-in is logged with its answer. The licences list filters by product, state and binding, and the JSON API can create, read, suspend and reissue licences for your own tools.
Frequently asked questions
Is the Licensing Manager an extra cost?
No. It is part of every CoreInto plan. WHMCS, for comparison, sells its Licensing Addon separately.
What can a licence be bound to?
An IP address, a domain, a folder, a machine identifier or a combination of them.
How does my program know an answer is genuine?
Every answer is signed with your private key. Your program checks it with the matching public key it carries.
Can clients move their licence to a new server?
Yes. They reissue it from the service page, and the next check-in binds it to the new server. You can limit how often.
