8 ms·
Show HN: Keygen – A dead-simple product licensing API built for developers
- ezekg 10y agoHey everyone! I'm the creator of Keygen and would love to answer any questions that you may have about it. I've been developing the API for over 6 months and figured I'd try and gather feedback on the product through a beta before the big launch day. I'd appreciate any feedback at all!
- jbpetersen 10y agoI love the glitch aesthetic and hope to see it become a trend.
- NKCSS 10y agoI love the design of the site; looks great!
- ezekg 10y agoThanks! Years ago I was a graphic designer, so I like to do a little design every now and then. Being able to code lets the creativity really flow!
- eb0la 10y agoFirst of all, this looks a good idea to me. "Traditional" license management servers (like FlexLM) are a scary piece of software for sysadmins: think of it like a black box that will shut down everything if you mess up. This license-as-a-service makes operations very easy. I wonder if you have in mind something about concurrent users. I mean, some software is licensed on a _concurrent_ user basis, not just per seat. If a user logs-in twice, usually the LM revokes the license for the session that was active, and assigns a new one to the user that just logged-in. Also, license reporting is also a good idea for answering questions like... how much do I have to pay for next year maintainance?
- ezekg 10y agoThanks for the kind works. I'm still working out pricing, and the beta will help iron out any kinks and see how I can best calculate usage. I may end up starting out with fixed-price plans that are based on product, user, and license count. I'll keep the rest in mind, thanks!
- ezekg 10y agoHey, I realized that I guess I had misread your post, so my previous reply doesn't answer your question. Support for detecting/revoking concurrent users is a great idea and I will be sure to come back to that in the future. As of now, that will have to be done outside of Keygen.
- tmikaeld 10y agoReally nice idea, congrats on launching! The website design is REALLY refreshing and feels professional. Question: I guess this is software as a service, what happens if the service would shut down - for whatever reason?
- ezekg 10y agoHey, thanks! I'm glad the design is such a hit. I will have a contingency plan in place that will likely involve open sourcing the API so that it can be self-hosted.
- nzjrs 10y agoHow about, at the very point one sets up their app to use your service, they provide a secondary api endpoint of their choice (licserver.customerdomain.com). That way if your server goes belly up, it falls back to their domain for license management without the user have to update their software because the vendor needs to point to a new service.
- ezekg 10y agoGood idea. I'll create an issue for that to come back to in the future.
- dgudkov 10y agoWhat if customer computers are not connected to the internet? Is there a way for off-line licensing?
- ezekg 10y agoNothing planned. Keygen is made for online-based products. You can either validate when an active internet connection is available, disable offline access (which should be avoided) or simply let it be. In the end, it's up to the product developer.
- Retr0spectrum 10y agoIf the API is publicly documented, how will you stop people from just spoofing the licensing server? I assume you've addressed this issue, but I'd love to know how. Edit: From reading a bit more, I understand that this service is mainly aimed at web/online apps, so piracy is a non-issue.
- mappu 10y agoI assume a combination of public/private keypairs and timestamping. If you trust the client to say "yes, validate via the keygen.sh API", then without loss of generality you can probably trust it to validate using a public key and a timestamp.
- ezekg 10y agoYes, this is for online/web-based apps, with an emphasis on JavaScript apps built on Node, Electron, etc. Licenses are validated by making an authenticated GET request to something like `https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/validate` https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/vali.... Depending on how you manage users, you can require them to login (request an API token) before being able to access your app. Depending on if you're performing the validation server-side or client-side, you can either use a product-specific API key (private) or the license owners API token (a signed in user), respectively.
- mappu 10y agoHow do libraries for PHP work? You only need a key management service like this when you go from SaaS to on-prem/equivalent, at which point PHP is in the unenviable position of having readable source files. It's possible to patch out license checks from any language, but PHP makes it pretty easy - what's your approach to solving this? Ioncube-style binary extensions? If so, PHP7/opcache compatibility?
- meritt 10y agoHow is your question any different for Perl, Python, Ruby, or Node.js?
- mappu 10y agoIt's different for Go.
- ezekg 10y agoTo validate a license key requires an active internet connection. There is no compilation or obfuscation because your app never contains any license keys directly. All of the logic is handled via the API. Validating a license would require performing a GET request to a users license validation endpoint.
- regecks 10y agoI think it's odd to offer a service like this with no protection against cracking. I mean, sure, I licence one of my own products with a RSAPSS signature on an environmental constraint .. but if somebody went to the effort they could just flip a single instruction to bypass it. However, I am pretty sure nobody in my target market will bother. However, I don't think that would hold with something like this. What stops people releasing a bunch of generic bypass/crack tools against your client SDKs?
- ezekg 10y agoTo validate a license key requires an active internet connection. This is for online/web-based apps, with an emphasis on JavaScript apps built on Node, Electron, etc. Licenses are validated by making an authenticated GET request to something like https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/validate https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/vali.... Keygen isn't meant to be used for offline apps, as license validation requires an authenticated API request.
- ago 10y agoDid you reply to the right person? Your reply does not seem to address anything that was said.
- ezekg 10y agoYes. What prevents cracking is the fact that license keys can only be created if you are either an authenticated user of the account or authenticated with a product API token. In order to create a license crack, you would have to obtain a valid API key for that specific account. Everything with the API is done over the wire, meaning there are no public/private keys within your app to crack.
- deleted 10y ago[deleted]
- wyday 10y ago
- matlo 10y agoHow is the glitch effect on the website implemented? I tried to find out with chrome debugger but i still don't understand.
- chrismorgan 10y agoFirefox’s tracking protection is preventing the “Get Early Access” button from working, just putting this warning into the console: > The resource at “https://mc.us14.list-manage.com/subscribe/form-settings?u=0da915687b658ef99fb6b9075&id=8e6c7696a2&u=0da915687b658ef99fb6b9075&id=8e6c7696a2&c=dojo_request_script_callbacks.dojo_request_script0” https://mc.us14.list-manage.com/subscribe/form-settings?u=0d... was blocked because tracking protection is enabled.[Learn More]
- jasonkostempski 10y agoYou can't have DRM without tracking :)
- ezekg 10y agoHey, thanks. I'll check out what the deal is. There have been a few other issues in Firefox.
- sorenjan 10y agoDo people not test their sites in Firefox anymore?
- ezekg 10y agoI did extensive testing in FF. This seems to be an issue related to privacy settings: https://github.com/rydama/mailchimp-ajax-signup/issues/6 https://github.com/rydama/mailchimp-ajax-signup/issues/6. I will look into additional ways to allow sign ups that don't have this issue.
- Washuu 10y agoThe fact that MailChimp got on to Firefox's privacy block list is not too surprising to me. I deal with many daily spam emails that all originate from MailChimp. No amount of checking off on their unsubscribe form that the senders are using MailChimp as a spam service actually gets some sort of invention to occur. Personally I am glad that they are being flagged since they do not do much to stop spammers.
- codedokode 10y agoWhat happens if the company that hosts a licensing server goes out of business?
- ezekg 10y agoI will have a contingency plan in place that will likely involve open sourcing the API so that it can be self-hosted.
- pyre 10y agoDepending on how the company crashes and burns, couldn't that be prevented from getting enacted? For example, I can't imagine that investors would be too happy that the company's "biggest" asset would be given away in that situation. Same goes for (possibly) filing for bankruptcy. Wouldn't creditors have a say?
- domlebo70 10y agoDo any services exist that fill the niche of "I have built an API, and I now want to charge for it"? API tokens, billing, metrics, etc
- jensvdh 10y agoActually Amazon offers this as part of its API Gateway service.
- rblatz 10y agoI know Azure has API Management https://azure.microsoft.com/en-us/services/api-management/ https://azure.microsoft.com/en-us/services/api-management/ It doesn't look like it has the built in monetization, but it should be fairly easy to smash a payment provider and API management together.
- doublerebel 10y ago3scale, Apigee, there are many of these services
- Artemis2 10y agoMashape?
- ezekg 10y agoSomebody should get on that. Metered billing definitely hasn't been easy to build using Stripe.
- natdempk 10y agoIs this validation actually performant or secure? It seems like if you implement this on the client side, you end up using JavaScript and the client can just run code that patches the call to the server to have it always pass. Then if you implement this on the server side, then you pay a latency penalty for every request, as you have to verify the token sent to your server against the keygen.sh server. It seems like this is either insecure or you pay an RTT latency penalty on every authenticated request. Is this correct? Is there something I'm missing here?
- seanwilson 10y ago> It seems like if you implement this on the client side, you end up using JavaScript and the client can just run code that patches the call to the server to have it always pass. Not sure there's anything practical you can do about that. You're not going to be able to stop hackers figuring out a bypass. Your goal should be to make the license check bypass inconvenient enough that regular users would rather pay for a license (e.g. requires a new bypass each version upgrade).
- ezekg 10y agoDefinitely. I've seen implementations that require a login before the app is able to be used, but also others that simply have a flash message that kindly asks the user to login. If your app performs auto-updates, then you can also require a valid license before updating, which would be handled server-side somewhere. In the end, it all depends on the product.
- ezekg 10y agoThat's assuming that you require license validation with every request though, when in reality you really only need that information periodically. If you're using Keygen alongside your own API, then that information can be cached and requested when needed. It would be integrated the same way you would integrate something like Stripe; you request information when required, and keep your own records up to date via webhook events. For example, a desktop app would really only need to validate a users license after they have successfully logged in after booting the app; you likely wouldn't need to validate the license again for at least 24 hours, and that's assuming you wanted to perform periodic license validations for long-running sessions.
- vbsteven 10y agoI wonder how you can avoid users from tampering with the licence check in dynamic languages like javascript and ruby where anyone has access to the node_modules or rubygems directories. I know this is not the focus of this particular product but since it has come up in multiple comments. How could this be solved?
- Normal_gaussian 10y agoMake it a super pain to mess with. Lace the code with license checks (different ones, not the same repeated) and run an obfuscator. Works best with an external license server. If you have to be offline make the checks more involved.
- BillinghamJ 10y agoIt is also worth noting - how much do those cases really matter anyway? If they're going to the bother of disabling your licence checks, they probably aren't going to buy it anyway.
- ezekg 10y agoIt's a fear that many have. When dealing with JavaScript based apps, where all of the source code is readable (more or less), there's really no way around the possibility of that happening. All you can do is require that updates and support require a license key. In the end, that will be a small amount of your users. Every software company deals with this issue a little differently.
- cstuder 10y agoDoes anyboday have any recommendation for a self hosted licencing system?
- husted 10y agoI would also like to get some recommendations for self hosted systems. Anyone?
- edwinyzh 10y agoI am also interested in a self-hosted licensing server (for Linux).
- tmikaeld 10y agoThere is this: http://dev.nauck-it.de/projects/license-manager http://dev.nauck-it.de/projects/license-manager
- cstuder 10y agoI found Portable.Licensing by Nauck too, but have you any experience with it? I'm just kinda confused that there are not more self hosted libraries for this.
- tmikaeld 10y agoHaven't tried it unfortunately - back in 2005 when we looked at licensing, we came to the conclusion that we might as well do it ourselves. But having a proper open source solution would be better, easier to audit and better collaboration.
- ezekg 10y agoHey, I'm going to offer on-prem licenses for the API for companies that would rather host in-house. Would you be interested in that?
- cstuder 10y agoYes, I would. Any timeframe on this?
- m6w6 10y agoJust a quick note yet: not sure "evilcorp" is the best of names for an example, though. EDIT: Definitely enjoying the slightly creepy visual haxor effects, though.
- porker 10y agoI've been thinking about licensing recently, in the context of package managers. How can you allow people to install and update commercial packages, without the problem that anyone can use any key? I'm thinking particularly in terms of software which is licensed to run on 1 domain, 3 domains, 5 domains etc - but as soon as you use a CLI package installer, you don't know the domain being used.
- ezekg 10y agoI'll be handling it the same way Stripe handles their libraries: https://github.com/stripe/stripe-node#api-overview https://github.com/stripe/stripe-node#api-overview. Account tokens are cryptographically sound enough so that it would take ages to 'find' a correct token, much less the correct token AND account. Restricting licenses by domain would need to be handled outside of Keygen; you can track the allowed machines (via fingerprinting) through the Keygen API, and then act accordingly.
- ezekg 10y agoI'm absolutely thrilled by the response so far! I didn't expect to get such a large amount of interest so fast. I already have hundreds of users interested in the early access program. I'm going to be hard at work the next couple weeks writing documentation and developing the rest of the web app (API is ready) so that we can get this ball rolling!