Licencly 1.0.1

Licencly for .NET

Verify Licencly licenses and check for entitled updates, from .NET.

dotnet add package Licencly

Targets net8.0 and netstandard2.0, the latter deliberately, because a great many Windows desktop ISVs are still on .NET Framework 4.6.1+ with a codebase they are not going to port to run a licensing check.

The idea

The signed license file is the answer; the network is an optimisation. The client reads its cache, refreshes when due, and keeps working through an outage until the grace period is spent, so Licencly being unreachable never stops software you have already sold.

Quickstart

Copy the product UUID and public key from your dashboard and embed them at build time. Fetching keys at runtime would defeat the whole scheme.

using Licencly;

var client = new LicenclyClient(new LicenclyOptions
{
    ProductUuid = "fec65576-…",
    // Products → your product → Signing key.
    PublicKeys = new Dictionary<string, string>
    {
        ["9f2c1a44-…"] = "MWvD7YE6HjI/DQ0kYGJFNG4kXlx4hP6ck1Vr4j77fzk=",
    },
    Fingerprint = MachineId(), // yours; see below
});

var decision = await client.ValidateAsync(userEnteredKey);

switch (decision.Outcome)
{
    case Outcome.Valid:
        break; // run
    case Outcome.NotActive:
        Show("This license has been suspended or revoked.");
        break;
    case Outcome.Expired:
        Show("This license expired. Renew to continue.");
        break;
    case Outcome.WrongMachine:
        Show("This license is in use on another machine.");
        break;
    case Outcome.Stale:
        Show("Please connect to the internet to re-check your license.");
        break;
    case Outcome.Invalid:
        Show("This license file could not be verified.");
        break;
}

ValidateAsync makes no network call at all while the cached file is still fresh.

Offline

A LicenclyNetworkException inside the grace window is not an error your users should see. The cached decision is returned instead, and you only see the exception when there is no cache at all.

Where the cache lives

%APPDATA%\licencly\, not next to your executable. An application installed in Program Files cannot write beside itself without elevation, and a licensing check that needs admin rights will not have them when it matters.

Updates

var result = await client.CheckForUpdateAsync(key,
    currentVersion: "1.2.0", platform: "windows", arch: "x64");

if (result.Available)
{
    var path = await client.DownloadArtifactAsync(key, result.Release!, tempDir, artifactPublicKey);
}
else if (result.RenewalWouldUnlock)
{
    // Not an error: a newer version exists and this license is not entitled to
    // it. result.Latest names what renewing would unlock.
    Show($"Version {result.Latest!.Version} is available with an active plan.");
}

Checking for updates never consumes a seat.

Verifying downloads

artifactPublicKey is your own Ed25519 public key, compiled into your application, not fetched from Licencly. Licencly stores and serves the signature but cannot produce one, so a compromise of Licencly cannot push code to your users. DownloadArtifactAsync verifies the digest and that signature before the file is moved into place; passing null reduces it to corruption detection.

Machine fingerprints

The SDK does not compute one, because a good fingerprint is specific to what you ship. It must stay stable across restarts, app updates and reboots, and survive minor hardware change. On Windows, MachineGuid and a volume serial are common starting points; both have failure modes worth reading about. VMs, containers and cloned disks defeat naive approaches.

Leaving Fingerprint empty disables machine binding, and a license file copied to another machine will still verify.

Clock tampering

Expiry is checked against a clock the user controls; rolling it back extends an expired license offline. This is unavoidable for anything that must work without a network.

The SDK records the furthest-forward time it has seen and rejects a jump backwards of more than 24 hours. That is a speed bump, not a fix.

Errors worth telling apart

Dependencies

BouncyCastle.Cryptography, because .NET has no Ed25519 in the base class library on any target this package supports. The alternative is implementing field arithmetic by hand, which is the wrong answer for signature verification.

Conformance

dotnet test

Runs data/vectors.json, the same suite every Licencly SDK runs. If this SDK ever disagrees with the Go, TypeScript or Python ones, that test fails first.