The CLV1 protocol is now publicRead the spec
Browse the library

Documentation libraryGetting started

Ship to your customers

Once your software has passed the [test list](/docs/before-selling), three jobs remain: get the build to customers, get keys to customers, and help customers when they get stuck. This guide gathers the three, each part pointing to the detailed guide.

3 min read

1. The build

  • The build carries your app's API address, App ID and public key. The public key only checks signatures, so embedding it is safe; never embed any secret key.
  • Declare the right version (appVersion or its name in your SDK): the server uses it to block builds that are too old and to announce new ones.
  • Release through ClavisAUH to get signed builds, download links that expire after 5 minutes, and software that checks for updates itself: Signed releases and updates. You can still release through your own channel.
  • Before changing signing keys, release a build that carries both the old and the new key: Signing keys and rotation.

2. Get keys to customers

WaySuitsRead more
Make keys on the dashboard and send themFew sales, direct salesCreating and managing licenses
Your store calls the Seller API on each orderOnline sales, automaticSelling with the Seller API
Resellers make keys with the credit you give themSales through partnersResellers and credit

Whichever way:

  • The full key shows only once, when it is made. ClavisAUH keeps only a hash, so send or save it right away.
  • Attach the buyer's email to the license: the buyer can sign in to the customer portal and gets a reminder before it expires.
  • For your own systems to learn when a key is activated or about to expire, subscribe to Webhooks.

3. Customers help themselves

Turn on the customer portal for the app: buyers sign in with their email or their key, see their licenses, and remove an old machine themselves under the transfer rules you set (Devices, HWID and transfers). Most "I changed my computer" requests no longer need you.

4. When a customer cannot get in

  1. Paste the customer's key into search (⌘K or Ctrl K): the dashboard opens that key's license.
  2. In the detail panel, Recent SDK calls lists the latest calls, refused ones with their reason. Everything is in the Activity log.
  3. Act on the reason:
ReasonUsuallyYou
invalid_credentialsA mistyped key, a key of another app, or one no longer usable on a machine without a seatCheck the key and the app; look at the license's state
device_limitThe customer changed machines or installed on a second oneReset devices, or let the customer remove the old machine in the customer portal
license_expiredIt expiredExtend
license_suspendedYou suspended itReinstate if it is fine
update_requiredThe customer's build is below the minimum versionSend the new build
network_error, timeoutThe customer's network, firewall or proxyAsk the customer to allow connections to your API address

The error sentence the customer sees is that code's sentence in the error codes table, so whatever sentence they read to you tells you the code.

How can we help?

Frequently asked

What is ClavisAUH?

A licensing and authentication service for desktop software: license keys, device binding, end-user sign-in and signed responses. All run from one dashboard

Why can't a cracker fake your server?

The SDK only trusts answers signed with your app's private key. That key never leaves our servers, so a fake server can't sign and gets rejected

What ends up in my binary?

Your app id and public key. Nothing secret, because each device makes its own key pair on first run

Does it work offline?

Yes. Every plan gets a signed offline token for 7 days, and your app checks it locally. Premium lets you choose how long. A revoked license can keep working offline for that time, unless Online-Only Mode is on

Which languages are supported?

JavaScript and TypeScript today. C++, C# and Python are next, on the same open protocol

Is Basic really free?

Yes. No time limit, no card. Move to Premium when you need more

Get in touch