One SDK for desktop, web & mobile. Runtime tamper detection, encrypted local cache, trial analytics, and zero-code license automation — all in one platform.
Same sequence whether you ship a desktop tool, a web app, or a mobile game. No separate systems to learn.
Sign up, open Settings to copy your Vendor API Key. Create a product, open the Integration Guide to copy your Product Key.
Paste both keys into your code. One validateLicense() call — same on every stack.
Tamper detection runs in the background. Trial analytics track conversions. You get a dashboard.
Pick your language. The shape of the check doesn't change.
// .NET — Desktop, web, mobile, Unity using UnifiedLicensing.v4; var manager = new UnifiedLicenseManager(config); var result = await manager.ValidateLicenseAsync( "LICENSE-KEY-HERE", ValidationMode.Online ); if (result.IsValid) { EnablePremiumFeatures(result.License); } // IntegrityGuard runs 5 background timers // — debugger detection, process blacklisting, // — fingerprint check, DLL integrity, hash validation var guard = new IntegrityGuard(integrityKey); guard.StartProtection();
// JavaScript — Browser, Node.js, Electron import { UnifiedLicenseManager } from 'unified-licensing'; const manager = new UnifiedLicenseManager({ vendorApiKey: 'ul_xxx', productKey: 'my-app-xxxx' }); const result = await manager.validateLicense('LICENSE-KEY'); if (result.isValid) { enablePremiumUI(result.license); } // Trial analytics — track what converts await manager.trackTrialStart(trialToken, { platform: 'web' }); await manager.trackFeatureUsage(trialToken, 'export'); await manager.trackTrialConversion(trialToken, 'paid-license-key');
# Python — Desktop, CLI, automation from unified_licensing import UnifiedLicenseManager manager = UnifiedLicenseManager( vendor_api_key="ul_xxx", product_key="my-app-xxxx" ) result = await manager.validate_license("LICENSE-KEY") if result.is_valid: enable_premium_features(result.license) # TamperDetector — runs automatically # Clock drift, debugger, env anomaly checks # Max 3 violations → blocks all validation
// PHP — WordPress, Laravel, WooCommerce use UnifiedLicensing\UnifiedLicenseManager; $manager = new UnifiedLicenseManager([ 'vendor_api_key' => 'ul_xxx', 'product_key' => 'my-app-xxxx' ]); $result = $manager->validateLicense('LICENSE-KEY'); if ($result->is_valid) { $this->enablePremiumFeatures($result->license); } // AES-256-GCM encrypted local cache // Grace period fallback on 429 errors // Platform-aware cache duration
Wherever your app runs, the same license record validates the same way — so you write the check once and trust it everywhere.
Licenses verify locally with a cached RSA-2048 signature. A build running on a laptop on a plane still checks out.
Check entitlements on load and re-check on demand. Built for HTML5 games, SaaS dashboards, and subscription-gated UI.
A user's activation follows them from phone to tablet, so reinstalling never means re-buying.
Connect your payment platform. Paste one webhook URL. Licenses generate and deliver automatically — branded emails included.
Stripe, PayPal, Gumroad, WooCommerce, Shopify, or any custom system.
Universal endpoint receives the payment event. Zero configuration.
Product mapped automatically. Key created, signed, and stored.
Branded email with license key. Customer activates instantly.
Map payment products → your license products. One-time, subscription, or tiered — each maps to the right key type automatically.
License keys delivered via your branded email templates. Custom sender, subject line, and HTML body. No generic "noreply" addresses.
Every webhook delivery, license generation, and email send is logged. Full audit trail in your dashboard. No black boxes.
Paste this into your Stripe dashboard, WooCommerce settings, or any payment platform's webhook config. That's it.
Every competitor validates at the network layer. We validate at the runtime layer — inside your app, where it matters.
SDKs actively fight reverse engineering. .NET gets 5 concurrent background timers (IntegrityGuard). Python & JavaScript get clock-drift, debugger, and environment-anomaly checks. Max 3 violations → all validation blocked.
UnifiedLicensingIntegrityGuard TamperDetector
Track feature usage during trials. See which features drive conversion. Server-side tracking by device fingerprint — can't be fooled by clearing storage.
trackTrialStart() trackFeatureUsage() trackTrialConversion()
Send test API calls and decrypt AES-256-GCM encrypted responses client-side. Verify your integration works before writing a single line of production code.
AES-GCM Decryption
Universal webhook works with Stripe, PayPal, WooCommerce, Shopify, Gumroad, and any custom system. Paste the URL, map your products, done. Branded delivery emails included.
Universal Webhook
Local license cache encrypted with AES-256-GCM. Machine-bound encryption keys. HMAC-signed files. Even if someone extracts the file, they can't read or modify it.
AES-256-GCM HMAC
The dashboard is simple on purpose. What it's backed by isn't.
Every license is cryptographically signed. Desktop SDKs validate locally against the cached public key — no network call needed.
Periodic heartbeats check license validity without full re-validation. SDKs cache the next allowed heartbeat time to skip unnecessary calls.
Activations, renewals, trial conversions, and platform breakdown — all in one dashboard instead of three.
One-line setup for web, desktop, or mobile managers. Same API shape across all platforms — createWebServerManager(), createDesktopManager(), createMobileManager().
Flags activation patterns that look like one key spread across unrelated machines. Hardware fingerprinting ties licenses to devices.
CDN-backed validation network. A check from anywhere resolves in under 200ms. Grace periods keep apps alive during outages.
Three attack vectors they'll try. Three reasons they give up.
They extract your API key from the client. Now what?
They attach a debugger. They try to NOP out the validation check.
They block network calls. They clear browser storage. They think they're safe.
"We switched from Keygen in a weekend. The tamper detection alone saved us from three reverse-engineering attempts in the first month."
"The grace period feature is genius. Our desktop app never shows 'validation failed' to users anymore — even when our API is under heavy load."
"Trial analytics showed us 68% of users who try the export feature convert to paid. We had no idea. Changed our entire onboarding flow."
Feature comparison against the most common alternatives. We're not the cheapest. We're the most complete.
| Feature | UnifiedLicensing | Keygen | Cryptlex | LicenseSpring |
|---|---|---|---|---|
| Runtime Tamper Detection | 3-tier (all SDKs) | — | — | — |
| Trial Feature Analytics | Start → Track → Convert | Trial only | Trial only | Trial only |
| AES-256 Encrypted Cache | All SDKs | — | — | — |
| License Automation | Universal webhook | Webhooks | Webhooks | — |
| API Testing Studio | Built-in | — | — | — |
| Offline Validation | Signed cache | Relay | License files | On-prem server |
| SDK Languages | 4 (C#, JS, Python, PHP) | 4 | 10+ | 5 |
| Free Tier | 50 licenses | 100 licenses | 50 licenses | Free tier |
| Starting Price | $9/mo | $49/mo | $99/mo | Custom |
You don't have to migrate everything at once. Start a new product on UnifiedLicensing alongside your existing provider. Run both in parallel — test the SDK, tamper detection, and automation on one product before committing. When you're ready, new customers go through UnifiedLicensing and you sunset the old system on your timeline.
Desktop SDKs cache a signed license record locally. Validation works offline. If the API is unreachable, the SDK falls back to cached data with a configurable grace period — your app never breaks.
10 licenses/month with full SDK access. Enough to validate the integration, test tamper detection, and ship a prototype. No credit card required. Upgrade when you have paying users.
Exactly the opposite. Solo devs don't have time to build licensing from scratch. One validateLicense() call replaces weeks of custom work. The free tier is designed for you.
No separate charge for adding web or mobile. Pick a tier by license volume, not by surface.
For validating the SDK on a single app.
For a shipping app with real users.
For growing products with trials.
For teams shipping on every platform.
For large fleets and compliance needs.
You don't have to migrate everything at once. Start a new product on UnifiedLicensing alongside your existing provider. Run both in parallel — test the SDK, tamper detection, and automation on one product before committing. When you're ready, new customers go through UnifiedLicensing and you sunset the old system on your timeline.
Desktop (offline-first): .NET (WPF, WinForms, Console, Unity), Python (Tkinter, PyQt, CLI), Electron, Tauri.
Web & HTML5: React, Vue, Angular, Next.js, Nuxt.js, Node.js, Express, Chrome extensions, HTML5 games.
Mobile: iOS (Swift, Objective-C), Android (Java, Kotlin), React Native, Flutter, Xamarin.
Server & PHP: Laravel, WordPress, WooCommerce, any PHP environment.
4 SDK languages: C#, JavaScript, Python, PHP.
No manual key generation. Paste your webhook URL into Stripe, PayPal, WooCommerce, Shopify, Gumroad, or any payment platform. When a customer pays, the webhook fires automatically — a license key is generated, signed, and delivered to the customer via branded email. Zero code required. You can also map specific payment products to specific license tiers, so a "Pro" purchase gets a "Pro" key with the right features unlocked. Every delivery is logged in your dashboard.
Desktop SDKs cache a signed license record locally. Validation works offline. If the API is unreachable, the SDK falls back to cached data with a platform-aware grace period — your app never shows "validation failed" to users.
Yes. The SDK caches the RSA-2048 signed record locally and validates it against the public key without contacting the server. This works on desktop, mobile, and even in air-gapped environments.
Tamper detection runs quietly in the background — it never blocks your app's main thread. On .NET, the IntegrityGuard performs continuous background checks: debugger detection, process blacklisting, fingerprint integrity, and hash validation. On Python and JavaScript, the TamperDetector monitors for clock manipulation, debug environments, and suspicious process changes. All checks are lightweight and non-blocking — your users won't notice a thing.
Existing activations keep validating. New issuance pauses until you upgrade or the next billing cycle starts. Nothing breaks for your current users.
Yes, from Account Settings. Downgrading takes effect at the start of the next billing cycle so you keep current-tier limits until then.
Desktop & mobile: Keep working. The SDK caches a signed license record locally and validates offline. No network call needed — your customers won't notice anything.
Web apps: depend on how you integrated. If you call the API on every page load, validation will fail once the account is deactivated. If you cached the validation result client-side (localStorage/sessionStorage), it continues working until the cache expires. The key insight: license keys are just strings. You can store them in your own database and build a simple validation endpoint if needed.
Yes. Click "Export" in the Licenses tab to download all license keys, customer assignments, and activation history as CSV (for Excel/Google Sheets) or JSON (for scripts and migrations). Keys are plain strings — no proprietary format.
You do. License keys, customer data, and analytics are yours. You can access everything via the API. If you delete your account, all data is permanently removed per our data retention policy.
Export your license keys from the Licenses tab (CSV or JSON). Keys are standard strings — any system that can validate them can replace us. The more involved part is swapping the SDK calls in your codebase, but since we use a similar pattern to most providers, the migration is usually straightforward.
Not yet. Current licensing is per-device with hardware fingerprinting. Floating/concurrent license support is on the roadmap for Q3 2026.
Contact our support team to discuss self-hosted deployment options for Enterprise customers.
Most developers validate their first license in under 15 minutes. The full integration — generate key, embed SDK, validate at runtime — typically takes under an hour. We provide platform-specific guides for every supported stack.
Yes. All data is encrypted at rest (AES-256) and in transit (TLS 1.3). We don't store payment information — only license keys and optional customer emails. We're GDPR compliant and support data deletion requests. Your customers' hardware fingerprints are hashed, not stored raw.
Your license keys are standard strings — they don't depend on our servers to exist. Desktop and mobile SDKs validate offline using cached signatures. We also provide a 90-day data export window if we ever shut down, so you can migrate to another provider.
License keys use the UL- prefix by default. Custom key formats and branded delivery emails (custom sender, subject, HTML template) are available on the Professional plan and above.
Your vendor API key never goes in client-side code. Only the product key (a public identifier like bm-crafts-my-nice-app-xxxxx) is embedded in the client — it's safe to expose because it only identifies which product is being validated, not your account. The vendor API key stays on your server for generating and managing licenses. For desktop and mobile apps, the binary is harder to reverse-engineer, and the SDK's tamper detection actively fights extraction. For web apps, keep the vendor key in your backend and call the API from there.
Yes. If you're not satisfied within the first 14 days of a paid plan, contact support for a full refund. No questions asked.
Issue your first key in under 5 minutes. No credit card required.