AL License System
A self-hosted license server for issuing keys after a sale, validating them on boot, enforcing per-server activation limits, revoking abuse and supporting customer lookup. The current storefront uses this D1-backed entitlement pattern; source tests cover key issuance and paid-download gating.
# validate from any product, any language curl -X POST https://appleluis.ltd/api/license/validate \ -H "content-type: application/json" \ -d '{"key":"APLU-7K2M-9QXR-4WTB-H3PZ","product":"al-store","fingerprint":"srv-01"}' # {"valid":true,"status":"active","activations_used":1,"max_activations":3}
What you get
Everything to run a license business
HMAC-signed keys
Keys carry a signed check group, so forged keys are rejected offline before any database hit. Real status lives in your datastore.
Activation binding
Bind a key to server fingerprints (IP, cfx code or domain) and cap how many installs a key allows. Move a key by deactivating an old slot.
Validate, revoke, expire
Active, revoked and expiry states, an append-only validation audit log, and per-key activation ledgers for support and abuse detection.
Drop-in API
One POST to /validate from any product in any language. A Node and a FiveM Lua client are included so you are validating in minutes.
Recovery endpoint
The included endpoint can email matching keys without exposing account existence once you configure an outbound mail provider. This store runs that sender against its own authenticated endpoint.
Cloudflare native
Runs on Pages Functions plus D1. No server to babysit, global edge latency, and it scales to zero cost when idle.
Deciding how to protect what you sell? Read how to protect and license your FiveM scripts.
Questions
How many servers can one key run on?
This license allows 3 activations by default. You can change the activation cap per product in your own catalog. Need more? Contact us for a team or unlimited tier.
Do my customers need a database?
The license server uses Cloudflare D1. The included install docs walk you through creating and binding it.
Can I protect products written in Lua or PHP?
Yes. Validation is a single HTTP POST, so any language that can make a request can validate. We ship Node and FiveM Lua clients as examples.