The CLV1 protocol is now publicRead the spec

One open protocol, every language

  • JavaScript
  • TypeScript
  • C++
  • C#
  • Python

01 / License management

Ship licensed softwareQuickly and easily

Clavis Authentication Engine started from one basic job: managing licenses, so you can ship licensed digital products quickly and without friction

1.1Key system

Every key has a clear life

Create in batches, attach a plan, follow the status, machines and history of each key

  1. 01BatchesPick a plan, a count, a note and the buyer's email, keys are shown once
  2. 02Clear statusesUnused, active, expiring, grace, expired, suspended, revoked
  3. 03One-click actionsExtend, suspend, revoke, free machines, add a note, change the buyer's email

1.2Structure

Everything in its place

A workspace holds apps, an app has license plans, a plan issues keys, a key binds machines

Data structure
  1. 01WorkspaceYour team, its plan and members
  2. 02AppOne product, one signing key
  3. 03License planDuration, machines, entitlements, trials
  4. 04License keyIssued in batches, stored only as a hash
  5. 05Devices and sessionsMachines recognised part by part
License lifecycle
  1. Unused
  2. Active
  3. Expiring
  4. Grace
  5. Expired
Suspended, can be reinstatedRevoked, stops at the next connection

Extending brings an expired license back into use

1.3Fast integration

Four steps, about five minutes

From a new account to the first key activated with a verified signature

  1. 01Create an appGet the public key to embed in your software
  2. 02Create license keysPick a plan, a count, a duration
  3. 03Add the SDKpnpm add @clavisauh/sdk and a few lines of code
  4. 04Try an activationRight on the dashboard's Quickstart page
JavaScriptC++C#Python
main.ts
import { ClavisClient } from "@clavisauh/sdk";

const clavis = new ClavisClient({
  baseUrl: "https://api.clavisauh.com",
  appId: "app_8f2aG91BcE043",
  appPublicKey: "Xq3…f1A", // verifies every response
  device: await describeThisMachine(),
});

const { license, variables } = await clavis.activate(key);
// Signature checked. Fake servers and replays never get here.

1.4Convenience

Buyers help themselves

Built-in sign-in, the customer portal and signed releases take the repetitive work off your hands

Three sign-in modes · key, account, or both

Customer portal · buyers free their own machines

Signed releases · forced updates, blocked builds

License management guide

02 / Copy protection

Alongside every releaseProtected from every side

Your license is held at the protocol, the device, the build and in operation, automatically and always with a clear reason

Threats and what stops themThe method behind each defense
  • A fake server answers "valid"Every response is Ed25519-signed with the app's private keyResponse Signing
  • An old response is replayedOne-time nonces, a stale clock is refusedReplay Protection
  • One key shared across machinesDevice binding part by part, key-sharing alertsDevice Binding
  • Keys guessed in bulkAt most 20 failures per 15 minutes per IPRate Limiting
  • The build is patchedIts hash is checked against your signed releasesBuild Integrity Verification
  • A cracked copy leaksLicense watermarks trace it back to the buyerForensic Watermarking

Don't just read it, try changing one byte of a signed response

2.1Two protection modes

A solid floor, a fine-tuned layer

Standard is 10 methods always on for every app. Advanced adds the ones you pick

2.2Protect 24/7

Someone tries to crack it, you know first

Unusual signals are scored, grouped into incidents and sent to email, Discord and Telegram

Sample · Discord alert

Protect 24/7Today at 02:14

High severity · key sharing

PRO-7KQ2M-…-9HTNC ran on 4 machines in 1 hour, re-login forced

Open

Studio Pro · high

Email · Discord · Telegram · signed webhook

03 / Seller API

Sell through resellersStay in control

Scoped API keys for shops and bots, resellers pay in credit

  1. 01

    Your shop takes an order

    A website, a Discord bot or your own system

  2. 02

    It calls the API for a key

    One Idempotency-Key per order, never sold twice

  3. 03

    The buyer gets the key

    Signed webhooks report each license change

shell
curl -X POST https://<api host>/seller/v1/apps/app_…/licenses \
  -H "Authorization: Bearer $CLAVIS_KEY" \
  -H "Idempotency-Key: order-1042" \
  -H "Content-Type: application/json" \
  -d '{ "policyId": "pol_…", "count": 1, "email": "buyer@example.com" }'
order.ts
const res = await fetch(`${host}/seller/v1/apps/${appId}/licenses`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLAVIS_KEY}`,
    "Idempotency-Key": "order-1042", // a retry never sells twice
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ policyId, count: 1, email: "buyer@example.com" }),
});
const { data } = await res.json(); // data.keys: shown once
order.py
import os, requests

res = requests.post(
    f"{host}/seller/v1/apps/{app_id}/licenses",
    headers={
        "Authorization": f"Bearer {os.environ['CLAVIS_KEY']}",
        "Idempotency-Key": "order-1042",
    },
    json={"policyId": policy_id, "count": 1, "email": "buyer@example.com"},
)
keys = res.json()["data"]["keys"]
  • Scoped tokensEach key does only what it was given
  • Credit ledgerKeys and credit move in one step
  • Signed webhooksEvery event HMAC-signed and retried for you
Selling with the Seller API

04 / Security community

Learn to defendFrom people who do

A community and a library for defending software, defence only

Pricing · two plans

Start freeUpgrade when you need to

Basic

Freeforever

Enough to ship your first protected app

  • 2 apps · 3 machines per key
  • Three sign-in modes, trials and a customer portal
  • Protect 24/7 looks back 1 day, email alerts
  • 500 MB for signed releases
  • 2 Seller API keys · 1 webhook

Premium

Most capable
Talk to usonline checkout coming soon

Higher limits, your choice of offline length and an audit log

  • 25 apps · up to 100 machines per key
  • Choose the offline length, plus an audit log
  • Protect looks back 30 days, automation, Discord and Telegram
  • 20 GB for signed releases
  • Resellers on credit · 25 API keys · 50 webhooks
Compare plansNo card required

Questions

A few thingsworth knowing

Read the docs
What is ClavisAUH?

A licensing and authentication service for desktop software: license keys, device binding, end-user sign-in and signed responses. All run from one dashboard

Why can't a cracker fake your server?

The SDK only trusts answers signed with your app's private key. That key never leaves our servers, so a fake server can't sign and gets rejected

What ends up in my binary?

Your app id and public key. Nothing secret, because each device makes its own key pair on first run

Does it work offline?

Yes. Every plan gets a signed offline token for 7 days, and your app checks it locally. Premium lets you choose how long. A revoked license can keep working offline for that time, unless Online-Only Mode is on

Which languages are supported?

JavaScript and TypeScript today. C++, C# and Python are next, on the same open protocol

Is Basic really free?

Yes. No time limit, no card. Move to Premium when you need more

Your softwareYour keys

Create your first app in minutes

Every sample on this page uses made-up data and runs in your browser

How can we help?

Frequently asked

What is ClavisAUH?

A licensing and authentication service for desktop software: license keys, device binding, end-user sign-in and signed responses. All run from one dashboard

Why can't a cracker fake your server?

The SDK only trusts answers signed with your app's private key. That key never leaves our servers, so a fake server can't sign and gets rejected

What ends up in my binary?

Your app id and public key. Nothing secret, because each device makes its own key pair on first run

Does it work offline?

Yes. Every plan gets a signed offline token for 7 days, and your app checks it locally. Premium lets you choose how long. A revoked license can keep working offline for that time, unless Online-Only Mode is on

Which languages are supported?

JavaScript and TypeScript today. C++, C# and Python are next, on the same open protocol

Is Basic really free?

Yes. No time limit, no card. Move to Premium when you need more

Get in touch