> It sounds like Keygen considers a "subscription" and a "license' to be a 1-to-1 relationship, correct? Keygen is actually pretty agnostic when it comes to bi

> It sounds like Keygen considers a "subscription" and a "license' to be a 1-to-1 relationship, correct? Keygen is actually pretty agnostic when it comes to billing -- if you want to have a one-to-many relationship with a subscription and licenses, you can definitely do that. Keygen doesn’t have a concept of a “subscription”, so third-party records, such as a subscription object in Stripe, can be associated with each other using metadata-based foreign keys for easy lookup on each side. In the case of multiple licenses -- you can have each license be a “seat” (or named license) and then manage each ones machines separately, like you mentioned, to assert an upper bound on multiple devices per-seat. > Curious about the distinction between these attributes. Maybe you can educate me: what's the difference between the license ID and license key? The license ID is a UUID that uniquely identifies it within Keygen’s system. A license key is a value that is more typical of a license, one that can be randomly generated by us upon license creation, or you can also supply a custom value. The license’s key is what most end-users will use, for validations. The ID is used for other requests, such as associating a machine activation to a given license ID. tldr; different identifiers for different use cases. But in your case, since the end-user wouldn’t be inputting the key themselves, the license’s key is largely irrelevant since you’ll be dealing with the license IDs. (Though the key could be used to assert uniqueness, e.g. setting the key to a named user’s email address hash.) > And does the API token restrict client access to just that licenses' information? We definitely would be validating licenses from a client/mobile app and not having app level API keys in the mobile client is certainly desirable. There are different types of API tokens that carry different privileges. But in general, most API requests will require some from of authentication token so that Keygen can assert the token has privileges to perform the request. This can largely be hidden away, and dynamic per-license, so you shouldn’t need to worry about embedding any tokens into your actual application. Happy to chat more via email, zeke@ -- HN may not be the best place for long form threads like this. :)