Upvm
Licensing Engine

Enterprise-grade license management

Domain-locked, IP-locked, seat-limited licenses with offline-verifiable activation tokens and signed webhooks.

Domain Locking

Bind licenses to specific domains with wildcard subdomain support. Prevents unauthorized use.

IP Locking

Lock to specific IPs or CIDR ranges. Supports IPv4-mapped IPv6 unwrapping.

Offline Verification

HMAC-signed activation tokens can be verified offline. No phone-home required for every check.

Seat Management

Set max activations per license. Revoke individual seats without affecting others.

Webhook Events

Receive signed webhooks on activate, validate, revoke. Integrate with your billing or CRM.

Expiry & Renewals

Time-limited licenses with automatic expiry. Integrate with subscription billing for renewals.

Simple REST API, powerful protection

Three endpoints cover your entire licensing workflow.

POST/license/activateActivate a license key with domain + IP binding
POST/license/validateValidate an activation token (online or offline)
POST/license/revokeRevoke a license (API key required)

How activation tokens work

Each activation issues a signed token: base64url(payload).hmac(payload, secret)

  • Offline verification: validate the HMAC signature without a server call
  • Server-side revocation: token hash stored on activation row, revocable on demand
  • Anti-tamper: any modification to the payload invalidates the HMAC signature
  • Expiry enforcement: tokens include expiration timestamp checked on every validate

Activation response

{
  "valid": true,
  "token": "<base64url>.<hmac>",
  "expiresAt": "2027-06-24T12:00:00Z",
  "product": { "id": "...", "name": "Pro License" },
  "activations": { "used": 1, "max": 3 }
}