Concepts

MinMaxKey has exactly four entities. Everything else is details.

Product

A product is one app you sell — "PixelForge Pro", "My CLI Tool", "That Unity Game". Each product has:

api_key — used on X-API-Key headers for activation/validation calls. Treat it as public: it only gates operations the license key already authorizes.
public_key — embed this PEM into your app for offline token verification. The matching private key never leaves your server.
a webhook URL + secret (optional) for license events.

Policy

A policy describes how a license behaves. One product can have many.

kind	meaning
`lifetime`	works forever, until revoked
`subscription`	expires after `duration_days`
`floating`	like lifetime, seat count is the whole story
`trial`	short `duration_days`, typically free

Plus:

max_seats — how many machines may be bound at once (0 = unlimited).
duration_days — for subscription/trial.

License

A license is one issued key: 9TMC-5TS9-0MKQ-VS8A-87Q0. It belongs to a product, follows a policy, and has a status (active / revoked), an optional customer email, and optional metadata. Expiry is computed from the policy at issue time.

The key format includes a CRC-16 checksum, so client apps can reject typos offline — the server is only consulted when it matters.

Activation (a.k.a. devices)

An activation binds a license to one machine fingerprint. Rules:

the same fingerprint on the same license always reuses its seat,
a new fingerprint consumes a seat until max_seats is reached,
deactivation frees a seat,
revocation stops every activation from validating (rows stay for the record).

Fingerprints are client-computed sha256 hashes of hardware identifiers. They survive reboots and most hardware upgrades — but not OS reinstalls, so budget for the occasional "customer reinstalled Windows" seat reset.

Offline tokens

Activation returns an Ed25519-signed JWT: sub (license key), product, policy, fingerprint (bound device), exp (subscriptions only), iat, jti. Your app verifies signature + expiry + fingerprint locally. See Offline tokens.

Webhooks

License lifecycle events, delivered as signed HTTP POSTs. See Webhooks.

The mental model

Product ──> Policy ──> License ──> Activation(s)
  │                    │
  └── public key       └── key string 9TMC-...  (customer-facing)
      for offline
      verification