License protection for digital products
ClavisAuthentication Engine
- Safe
- Fast
- Absolute security
License management, device binding, signed releases and 24/7 monitoring on one platform, with every response signed
- Every response signed
- Open protocol
- Free to start
pnpm add @clavisauh/sdk
One open protocol, every language
- JavaScript
- TypeScript
- C++
- C#
- Python
01 / License management
Ship licensed softwareQuickly and easily
Clavis Authentication Engine started from one basic job: managing licenses, so you can ship licensed digital products quickly and without friction
1.1Key system
Every key has a clear life
Create in batches, attach a plan, follow the status, machines and history of each key
- 01BatchesPick a plan, a count, a note and the buyer's email, keys are shown once
- 02Clear statusesUnused, active, expiring, grace, expired, suspended, revoked
- 03One-click actionsExtend, suspend, revoke, free machines, add a note, change the buyer's email
1.2Structure
Everything in its place
A workspace holds apps, an app has license plans, a plan issues keys, a key binds machines
- 01WorkspaceYour team, its plan and members
- 02AppOne product, one signing key
- 03License planDuration, machines, entitlements, trials
- 04License keyIssued in batches, stored only as a hash
- 05Devices and sessionsMachines recognised part by part
- Unused
- Active
- Expiring
- Grace
- Expired
Extending brings an expired license back into use
1.3Fast integration
Four steps, about five minutes
From a new account to the first key activated with a verified signature
- 01Create an appGet the public key to embed in your software
- 02Create license keysPick a plan, a count, a duration
- 03Add the SDKpnpm add @clavisauh/sdk and a few lines of code
- 04Try an activationRight on the dashboard's Quickstart page
import { ClavisClient } from "@clavisauh/sdk";
const clavis = new ClavisClient({
baseUrl: "https://api.clavisauh.com",
appId: "app_8f2aG91BcE043",
appPublicKey: "Xq3…f1A", // verifies every response
device: await describeThisMachine(),
});
const { license, variables } = await clavis.activate(key);
// Signature checked. Fake servers and replays never get here.
1.4Convenience
Buyers help themselves
Built-in sign-in, the customer portal and signed releases take the repetitive work off your hands
Three sign-in modes · key, account, or both
Customer portal · buyers free their own machines
Signed releases · forced updates, blocked builds
02 / Copy protection
Alongside every releaseProtected from every side
Your license is held at the protocol, the device, the build and in operation, automatically and always with a clear reason
- A fake server answers "valid"Every response is Ed25519-signed with the app's private keyResponse Signing
- An old response is replayedOne-time nonces, a stale clock is refusedReplay Protection
- One key shared across machinesDevice binding part by part, key-sharing alertsDevice Binding
- Keys guessed in bulkAt most 20 failures per 15 minutes per IPRate Limiting
- The build is patchedIts hash is checked against your signed releasesBuild Integrity Verification
- A cracked copy leaksLicense watermarks trace it back to the buyerForensic Watermarking
Don't just read it, try changing one byte of a signed response
2.1Two protection modes
A solid floor, a fine-tuned layer
Standard is 10 methods always on for every app. Advanced adds the ones you pick
2.2Protect 24/7
Someone tries to crack it, you know first
Unusual signals are scored, grouped into incidents and sent to email, Discord and Telegram
Sample · Discord alert
Protect 24/7Today at 02:14
High severity · key sharing
PRO-7KQ2M-…-9HTNC ran on 4 machines in 1 hour, re-login forced
Open
Studio Pro · high
03 / Seller API
Sell through resellersStay in control
Scoped API keys for shops and bots, resellers pay in credit
- 01
Your shop takes an order
A website, a Discord bot or your own system
- 02
It calls the API for a key
One Idempotency-Key per order, never sold twice
- 03
The buyer gets the key
Signed webhooks report each license change
curl -X POST https://<api host>/seller/v1/apps/app_…/licenses \
-H "Authorization: Bearer $CLAVIS_KEY" \
-H "Idempotency-Key: order-1042" \
-H "Content-Type: application/json" \
-d '{ "policyId": "pol_…", "count": 1, "email": "buyer@example.com" }'
const res = await fetch(`${host}/seller/v1/apps/${appId}/licenses`, {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.CLAVIS_KEY}`,
"Idempotency-Key": "order-1042", // a retry never sells twice
"Content-Type": "application/json",
},
body: JSON.stringify({ policyId, count: 1, email: "buyer@example.com" }),
});
const { data } = await res.json(); // data.keys: shown once
import os, requests
res = requests.post(
f"{host}/seller/v1/apps/{app_id}/licenses",
headers={
"Authorization": f"Bearer {os.environ['CLAVIS_KEY']}",
"Idempotency-Key": "order-1042",
},
json={"policyId": policy_id, "count": 1, "email": "buyer@example.com"},
)
keys = res.json()["data"]["keys"]
- Scoped tokensEach key does only what it was given
- Credit ledgerKeys and credit move in one step
- Signed webhooksEvery event HMAC-signed and retried for you
04 / Security community
Learn to defendFrom people who do
A community and a library for defending software, defence only
- 01A threat model for a licensed desktop applicationLibrary · official
- 02Why a binary can never keep a shared secretLibrary · official
- 03Detecting cracks in the wild: signals and tuning thresholdsLibrary · official
- Community postsSoftware makers share how they keep their apps safe
- Official LibraryTwelve foundation articles, in two languages
- Defensive content onlyNo cracking guides, no attack tools
Learning paths
05 / Documentation
Every featureHas its guide
From the first key to rotating signing keys, every feature has a step-by-step article
- guides
- 41
- guides
- topic groups
- 9
- topic groups
- languages
- 2
- languages
- Written from the source code and cross-checked
- Dashboard paths named exactly as on screen
- Code that runs against the real SDK and Seller API
- 01Getting started6Quickstart · Core concepts · Workspaces, members and roles · Test before you sell · Ship to your customers · Questions
- 02Get started by language11Node.js and Electron · Python · C# and .NET · Unity · C++ · Go · Rust · Java and Kotlin · The C library · Command line · Your own client
- 03Licensing7Creating and managing licenses · License plans and entitlements · Sign-in modes and trials · End users · Devices, HWID and transfers · Offline licenses · Customer portal
- 04Releases1Signed releases and updates
- 05Security7The two protection modes · Protect 24/7 · Alerts and channels · Access control · Signing keys and rotation · Activity log · Dashboard account security
- 06Integration5How the system works · JavaScript SDK · C++, C# and Python SDKs · App variables · Webhooks
- 07Selling2Selling with the Seller API · Resellers and credit
- 08Plans1Basic, Premium and limits
- 09Community1Protect Hub
Pricing · two plans
Start freeUpgrade when you need to
Basic
Enough to ship your first protected app
- 2 apps · 3 machines per key
- Three sign-in modes, trials and a customer portal
- Protect 24/7 looks back 1 day, email alerts
- 500 MB for signed releases
- 2 Seller API keys · 1 webhook
Premium
Most capableHigher limits, your choice of offline length and an audit log
- 25 apps · up to 100 machines per key
- Choose the offline length, plus an audit log
- Protect looks back 30 days, automation, Discord and Telegram
- 20 GB for signed releases
- Resellers on credit · 25 API keys · 50 webhooks
Questions
A few thingsworth knowing
What is ClavisAUH?
A licensing and authentication service for desktop software: license keys, device binding, end-user sign-in and signed responses. All run from one dashboard
Why can't a cracker fake your server?
The SDK only trusts answers signed with your app's private key. That key never leaves our servers, so a fake server can't sign and gets rejected
What ends up in my binary?
Your app id and public key. Nothing secret, because each device makes its own key pair on first run
Does it work offline?
Yes. Every plan gets a signed offline token for 7 days, and your app checks it locally. Premium lets you choose how long. A revoked license can keep working offline for that time, unless Online-Only Mode is on
Which languages are supported?
JavaScript and TypeScript today. C++, C# and Python are next, on the same open protocol
Is Basic really free?
Yes. No time limit, no card. Move to Premium when you need more
Your softwareYour keys
Create your first app in minutes
Every sample on this page uses made-up data and runs in your browser