I'll be handling it the same way Stripe handles their libraries: https://github.com/stripe/stripe-node#api-overview https://github.com/stripe/stripe-node#api-ov

I'll be handling it the same way Stripe handles their libraries: https://github.com/stripe/stripe-node#api-overview https://github.com/stripe/stripe-node#api-overview. Account tokens are cryptographically sound enough so that it would take ages to 'find' a correct token, much less the correct token AND account. Restricting licenses by domain would need to be handled outside of Keygen; you can track the allowed machines (via fingerprinting) through the Keygen API, and then act accordingly.