license control plane · spiky

Own the runtime, even when it is not your server.

Spiky turns a license key into a signed, machine-bound verdict your software can trust. Activate, verify, revoke, and kill a product from one control plane — while every server running it stays visible.

Open the control plane Read the API

Ed25519 signatures · nonce replay protection · 60-second revocation

Live entitlementRuntime allowed

{
  "type": "spiky.entitlement.v1",
  "product": "xcord",
  "licenseId": "lic_8F2A…",
  "fingerprintHash": "4d9e1c…a7",
  "allowRuntime": true,
  "reason": "active",
  "killSwitch": {
    "product": false,
    "license": false
  },
  "plugins": [
    "anti-cheat",
    "permissions"
  ],
  "killGeneration": 7,
  "nextCheckIn": 60
}

Runtime allowed

Toggle the switch. The signed verdict changes before the next check-in.

The parts a key alone cannot do.

Spiky does not stop at issuance. The control plane stays in the path of every runtime decision, with a signature the client can verify.

Machine-bound licenses

Every activation binds a fingerprint and server identity. Duplicate machines hit the activation ceiling; revoked machines stay revoked.

HWID · activation slots · expiry · signed entitlement

Kill switches that land

Suspend a license or kill a product. The next validation returns a signed denial and the panel records who did it, when, and why.

product kill · license kill · audit trail

Plugin entitlements

Enable, disable, or restrict individual plugins per product or per license. Client heartbeats report what is actually installed.

global toggle · per-license override · heartbeat report

Fleet visibility

See hostname, IP, version, region, plugins, and last heartbeat for every server using your products — licensed or not.

hostname · IP · version · region · last heartbeat

Three moves, one authority.

The client calls activation once, then validates on a short schedule. The panel can change the verdict between any two calls.

Issue

Create a product, mint an API key, and issue a license with a plan and activation limit.

Verify

Your client activates the machine, then validates on a schedule. Each response is signed and nonce-protected.

Control

Watch the fleet, disable a plugin, revoke a machine, or kill the product. The next check-in enforces it.

Trust is a verification path, not a promise.

The private key never leaves the server. Clients verify the public key, reject replayed nonces, and treat the panel as the only authority for revocation.

Ed25519 signed entitlement payloads
Nonce replay protection in Redis
API keys stored as hashes, shown once
Every privileged action audited

request pathauthority

Client SDKactivate

Spiky APIapi key

Redisnonce · limit

PostgreSQLlicense state

Signed verdictverify

Operatorkill · audit

Put your runtime on a leash.

Spiky is live on this deployment. Sign in, issue a demo license, and watch a server heartbeat appear.

Enter the control plane