SellstampLicences
A key that knows what it bought,
and where it is allowed to run.
Keys generated at payment from a policy frozen onto the order, bound to a machine, a domain, a person or a seat in a pool, and — on plans that include it — answered with an Ed25519 signature your own software verifies. Transferable, upgradable and releasable without a support ticket.
Validation response · signed
{
"valid": true,
"expiresAt": null,
"activation": { "active": true, "remaining": 2 },
"tier": "pro",
"features": ["teams", "api"],
"offlineGraceDays": 14,
"issuedAt": "2026-09-15T09:12:04Z",
"keyId": "k1",
"signature": "…"
}One keypair, one published verification key. The offline activation file returns exactly this shape.
What a key is, and when it stops working
Issuance reads the policy frozen onto the order, not today's product. Editing a product tomorrow does not change what you sold yesterday.
- Validity
- Perpetual, a number of days after purchase, or a fixed date. Decided once at issue from the order snapshot and never recomputed.
- Seats
- An activation limit on the licence, enforced against the authoritative rows under the licence's own row lock — never a cached counter that two concurrent activations can both read as fine.
- One binding, four readings
- There is a single binding column and it holds an HMAC. What was hashed into it depends on the mode, and a licence accepts its own field and refuses the others rather than silently binding something you never sold.
- Or keys you already have
- Import a pool of serial keys and have them handed out at purchase instead. Same order, same delivery, no generation.
- Device
- Node-locked to a machine your software identifies. Permanent until somebody releases it.
- Floating
- A seat in a pool, held by a lease rather than owned — fifteen minutes by default, with the client told to renew after a third of it, so two lost heartbeats still leave a third attempt inside the window. A crashed machine gives its seat back on its own.
- Domain
- A hostname, for software with no machine to fingerprint: a plugin, a theme, a self-hosted app.
- User
- The person the licence was sold to, so their laptop and their desktop are one activation.
What the signature carries
Sellstamp could tell your software whether a key was usable. It could not tell it what the key bought — so a merchant selling Basic and Pro shipped two builds, and an upgrade meant a re-install. That is inside the signature now.
Entitlements
The features this licence includes, signed alongside the verdict, so one build can unlock what the customer paid for and nothing more.
An offline grace window
How long your software may keep running without reaching us, stated by you and carried in the signed answer rather than guessed at by every integration separately.
Ed25519, one keypair
Verified against one published key, on plans that include signed validation. Update manifests are signed by the same key with a SHA-256 for every file, so software that already checks a licence needs nothing new to check an update.
A machine that can never reach the internet activates by file: it writes a short request, a human carries it to a browser, and the response that comes back is exactly the same signed validation response your SDK already verifies — same fields, same canonicalisation, same key. Both files are printable text, so they survive being emailed, pasted into a ticket, or retyped off a screenshot.
Upgrades keep the key
Selling five more seats by issuing a second, unrelated key means your software has to be taught which one is authoritative, and every later transfer or revocation has to be done twice.
One licence, one key, a row saying what changed
The seat count or the tier moves on the licence the customer already has.
An upgrade is a purchase
It writes an ordinary order, priced from your own catalogue, paid down the same funnel and invoiced when the money arrives.
Unless a subscription is behind it
Then the change is the provider's plan change and the provider computes the proration. A downgrade returns nothing — it changes what the licence allows from here on.
Transfer and resale
- Your policy, frozen at issue
- None, approval-required, or free — set on the product and written onto the licence when it is issued, so changing your mind later does not rewrite what a customer already bought.
- The recipient has to accept
- The holder proposes and the recipient confirms through a single-use link. Ownership moves on acceptance and never before — otherwise a transfer to an address that never agreed would be a way to make somebody's licence disappear.
- Completing one clears the old machines
- Every activation is released and the previous owner's seats revoked. Anything else ships one licence in use by two parties, which is the failure this exists to prevent.
- The licence transfers, the receipt does not
- The order, the invoice, the payment, the revenue and the affiliate commission all stay pointing at the sale that happened. Only the licence's owner moves.
- Sellstamp adjudicates nothing
- A perpetual licence sold in the EU may carry resale rights a “none” setting cannot remove. Sellstamp says so once, on the policy screen, and then detects no jurisdiction and overrides no merchant.
Seats, and customers who can help themselves
Most licence support tickets are a customer asking you to free up a machine they no longer have. Both of these exist so they do not have to ask.
The purchaser administers their own seats
On a user-bound licence, they add and remove colleagues by email address. Sellstamp creates no account for a colleague and sends no portal link — they get the key and activate with it.
Releasing one device
A customer can release one of their own activations from their order page or their account, if you leave the switch on. One device — never the key, never the licence's status, never all of them at once.
Revealing a key is a step-up
Showing a key or resetting activations from your dashboard needs a fresh proof of identity on top of the permission, because a permission says this person is allowed to and step-up says the person at the keyboard is really them.
When a key leaks
A key gets pasted into a forum or a group chat and strangers start validating with it. The activation count cannot see that — the limit pins it at the ceiling forever — but the validation record can.
Sellstamp counts the distinct bindings that have validated against one of your licences and compares it with what that licence was sold for. It is advisory and nothing else: it suspends nothing, revokes nothing, deactivates nothing and emails nobody. Resetting the activations, reissuing, writing to the customer, or deciding it is a studio with fifteen render boxes is a judgement only you can make. It counts bindings, and says which kind — a domain-locked licence’s count is a count of hostnames, not machines.
What this does not do
- No location, ever. There is no IP-to-country table and no region on any event, so a leak finding says “N distinct devices” and can never be made to hint at “N countries”.
- No automatic revocation on any signal. Every enforcement action is a merchant's.
- No raw device identifier stored anywhere. Everything a licence binds is an HMAC, under a key used for nothing else.
- No cross-merchant licence correlation. A leak signal asks only about your own key, on your own store.
Open a store and try it.
Everything on this page is in the product today. Connect a provider in test mode and put a real order through it before you decide.