Quickstart

The path

Six steps: sign up, verify your email, create an app, create a license key, connect your software and try an activation. Once you are signed in, Workspace › Overview shows a Ship your first protected build card that links to each step and ticks items off as you finish them. It disappears once all four of its items are done.

1. Sign up

1. Open the ClavisAUH sign-in page and pick the Sign up tab.
2. Fill in Display name, Email and Password.
3. Click Open your account.

Passwords must be 10 to 128 characters. The Password strength meter suggests upper and lower case plus a number or symbol, and a password known from a data breach may be refused. Sign-up refuses throwaway mail addresses. If the email already has an account, sign in instead, or use Forgot password? on the Sign in tab.

Every new account gets a personal workspace on the free Basic plan, with you as owner; no card needed. Compare plans on the pricing page.

2. Verify your email

You land on Your code is on its way. A 6-digit code goes to your address and stays valid for 10 minutes.

1. Find the code in your inbox (check spam too).
2. Type it into Verification code. The form submits by itself on the sixth digit, or click Verify.
3. You are signed in and taken straight to the dashboard.

If no email arrives, wait for the 30-second Resend in …s countdown and click Resend code. A typo in the address? Click Change email. Too many wrong tries invalidate a code, so ask for a fresh one. If you leave before verifying, nothing is lost: an unverified account cannot reach the dashboard, so your next sign-in sends a new code and brings you back here.

3. Create your first app

Every product you ship is an app, with its own license keys, users and signing key.

1. Go to Workspace › Apps.
2. Click New app.
3. In Create an app, enter a Name (2 to 64 characters, you can rename it later).
4. Click Create.

The dashboard confirms with "App created" and opens the app's Integration › Connect software page. The new app comes with:

• An App ID like app_…, sent with every request your software makes.
• Its own Ed25519 signing key pair. The Public key is yours to embed; the secret key stays sealed on the server.
• A default policy named Standard: 30 days, 1 device per key.
• The License key sign-in mode, so your software only calls activate(key).

The App ID and public key are always on the app's Overview page, in the Public key card.

4. Create a license key

1. Inside the app, go to Licensing & releases › Licenses.
2. Click Create keys.
3. In Create license keys, adjust the fields if needed. The defaults are fine for a first test.
4. Click Generate 1 key.
5. Save it with Copy all or Download .txt, then click I've saved them.

Keys look like XXXXX-XXXXX-XXXXX-XXXXX-XXXXX (or PRO-XXXXX-… with a prefix), drawn from an alphabet without look-alikes such as 0/O and 1/I. New keys start as Unused. Your plan also caps keys created per day; the count resets at 00:00 UTC.

5. Connect your software

The app's Integration › Connect software page takes you from your software's language to its first connection in four steps:

1. What is your software written in. Pick the language and the page names the way in that fits: an official SDK (Node.js and Electron, Python, C#/.NET, C++, Go, Rust, Java), the C library for any language that calls C (Delphi, VB6, AutoIt, Lua…), the command line tool for scripts and installers, or the protocol spec to write your own client.
2. How will your customers use it. Pick one or more scenarios: license key only (K1), accounts (K2), trial per machine (K3), end date and variables (K4), software updates (K5).
3. Your code. The API address, App ID and public key are filled in, with copy buttons. The code shown is each scenario's real sample file, run in CI in every language. Download the starter (.zip) gives a folder with the SDK and run scripts.
4. Wait for the first connection. The page listens live; when your software calls, it turns to Connected with the SDK, the operating system and the clock skew, and a refused call shows its code and how to fix it.

The choices of steps 1 and 2 live in the page's address, so a teammate you send the link to sees what you see.

Run the starter

1. In step 3, click Make a test key. The TEST key ends after 24 hours, stays outside the daily quota and goes straight into the run command.
2. Click Download the starter (.zip) and unzip it.
3. Run ./run.sh <key> (Linux, macOS) or run.cmd <key> (Windows; in PowerShell, .\run.cmd <key>). The scripts carry the app's settings; the last line reads OK k1 active.
4. Back on the page, step 4 turns to Connected.

A starter needs its language's toolchain, Node.js 20 or later for instance; the README in the zip says which.

The code that matters

This is K1 in JavaScript, quoted from the sample project. Make the client once, with a device key kept on the machine:

const client = new ClavisClient({
  baseUrl: env.CLAVIS_BASE_URL,
  appId: env.CLAVIS_APP_ID,
  appPublicKey: env.CLAVIS_APP_KEY,
  device: defaultDevice(),
  // The same key every run: sessions and offline tokens stay with this machine.
  deviceKey: loadOrCreateDeviceKey(join(STATE, "device.key")),
  appVersion: "1.0.0",
});

Activate, and without network fall back to the offline token saved last time:

let grant = null;
try {
  await client.init();
  grant = await client.activate(env.CLAVIS_LICENSE);
} catch (err) {
  if (!(err instanceof ClavisError)) throw err;
  // No answer (network_error, timeout...): a token saved last time keeps the software working.
  const offline = err.retryable && existsSync(SAVED) ? client.verifyOffline(readFileSync(SAVED, "utf8")) : null;
  if (!offline) {
    console.log(err.userMessage(LANG));
    console.log("FAIL", err.code);
    process.exit(1);
  }
  console.log("Offline: using the license saved on this machine");
}

• The SDK refuses every answer not signed with the app's public key. Never ship a secret key in your software.
• The device key signs each request. Keep it on the machine: sessions and offline tokens are bound to it. The seat on the license follows the machine's hashed identifiers (fingerprint and components).
• Hardware identifiers are hashed on the machine before they leave it.

Want an AI to do the integration? Copy a prompt for an AI agent at the top copies the steps for the language and scenarios you picked, with the App ID, public key and API address, ready to paste into a coding agent.

6. Try it in the browser

No machine handy? Open No machine handy? Try it in the browser under step 4. It activates a real key from your browser through the same signed protocol your software uses:

1. Paste your key into Paste a license key.
2. Click Activate.

Four lines tick off: request signed on this device (Ed25519), sent with a single-use nonce, response signature checked against your public key, session granted. On success you see Signature verified · license active with the session ID, expiry (or Lifetime), device limit and number of variables; step 4 turns to Connected as well.

This is a real activation. Your browser acts as a device named "Browser demo", its key pair and fingerprint kept in browser storage. The key moves from Unused to Active and its duration starts now. The session shows up in End users › Devices & sessions and a Key activation event lands in App security › Activity log.

When an activation is refused

Your software gets the code in e.code (or Code, code() depending on the language); the full table is in Error codes. On a machine that holds no seat on the key, every key that cannot be used (unknown, expired, suspended, revoked) answers the same code, invalid_credentials, so nobody can probe which keys exist; a machine that holds a seat hears the actual reason.

Next steps

• Choose how people sign in and offer trials: Sign-in modes and trials.
• Build license plans with their own duration, devices and features: License plans and entitlements.
• Ship configuration without a new build: App variables, and signed builds: Signed releases and updates.
• Pick your protection: The two protection modes and Protect 24/7.
• Issue keys automatically when orders come in: Selling with the Seller API and Webhooks.
• Secure your own dashboard account: Dashboard account security.

Related

• Core concepts
• JavaScript SDK
• Creating and managing licenses
• Sign-in modes and trials