Key-Warden is a software licensing platform for software vendors and ISVs. This is an honest, jargon-light walk through what a licence actually is, how your software checks it, and how seats, expiry, and revocation are enforced - so you can decide whether it fits before writing a line of code.
When a customer buys your product, Key-Warden issues a licence key: a unique reference tied to a product, a plan, a seat count, and (for time-limited plans) a duration. The key is what your customer enters or what your installer carries. On its own a string could be copied or forged, which is why the key is only half the story - the other half is a signature.
The key itself carries no entitlement. It is an opaque reference — the plan, the seats, the term and the status live on the licence record, not inside the string. That is what makes a renewal, an upgrade, a seat top-up, a suspension or a revocation take effect at the customer's next check, with nothing for them to paste. Under a self-describing key every one of those changes means issuing a new key and talking someone through replacing it.
When your software validates a key, the licensing API does not just reply "yes" or "no" in plain text. It returns an Ed25519-signed token. Your product embeds only the public half of a per-vendor signing key, and your SDK verifies the signature locally. A tampered, spoofed, or replayed answer fails that check and is rejected - even a "valid" response cannot be faked, because forging the signature would require the private key, which never leaves Azure Key Vault. Denials are signed too, so a blocked licence cannot be turned into an "allow" on the wire.
The signed answer is not a general-purpose pass. It names the licence it was issued for and the machine that asked, so lifting it from one installation and replaying it on another fails verification rather than granting a second seat. It is also short-lived by design: its own expiry is a refresh interval, not the end of the entitlement, so a copied answer stops working long before the licence does.
Because verification happens against an embedded public key, it does not need a live connection every time. You set an offline grace window; within it, your software keeps validating against the signed token it already holds. This makes licence key management practical for desktop apps, air-gapped installs, and field devices, not just always-online services.
The rules travel inside the licence rather than relying on an honour system. Seat limits count activations; node-lock binds a licence to a device by a salted, hashed fingerprint; expiry ends access when a term lapses; and revocation causes the next check to return a signed denial. Change a plan or revoke a key from one place and the enforcement follows automatically on the next validation.
Key-Warden handles issuing, signing, verification, and delivery; you keep the customer relationship and your own tax obligations. Checkout runs through Stripe or PayPal, keys and certificates are delivered by email (and optionally SMS), and you can see licences, seats, and invoices in your portal. See pricing for the plans and the platform fee.
Key-Warden ships SDKs for Node.js, Python, .NET and PHP, plus a software license API you can call from any back end. Whether you're shipping a WordPress plugin, a Dynamics 365 add-on, a desktop app or a SaaS product, the same signed-token model gates activation without bolting a heavyweight licensing server onto your stack. Whatever the platform, the contract is the same: a signed answer your software can trust.
Walk the full journey - product, licence, signing key, protection, vault, and sale - in the browser, or read exactly how data is secured. Become a vendor - Security and data.