Node-Locked Licenses

A node-locked license is bound to the machine on which it is activated. When your app activates the license, LexActivator generates a unique device fingerprint and sends it with the activation request. Cryptlex stores that fingerprint and checks it on every further activation attempt, so the same license key cannot be used on another machine.

Whether a hardware change breaks the match depends on the license's fingerprint matching strategy. Exact treats any minor change as a different machine, while Fuzzy, the recommended strategy, tolerates minor changes. Loose applies a lower threshold for machines that report unstable fingerprints.

This is the most common licensing model, and the right default when each of your customers runs your app on a known set of machines.

You implement it with LexActivator embedded in your app, which handles device fingerprinting, encrypted local license storage, virtual machine detection, time tampering detection, and periodic server sync for you. It also determines how the license is activated, online or offline, and how an activation is scoped across the machine's OS users.

Your app does not contact Cryptlex servers on every launch. IsLicenseGenuine() validates the stored activation locally by checking its cryptographic signature, which works offline and adds no startup latency, and the server sync runs in a background thread. See verify locally, sync in the background.

Online and offline activation

A node-locked license can be activated online or offline. When the machine has internet access, your app can activate directly against the Cryptlex servers. When it has no internet access, you activate offline by exchanging request and response files through the admin or customer portal. See Offline Activations for the offline process.

An offline activation is validated and enforced exactly like an online one. The difference is that a machine with no connection never syncs, so a renewal, suspension, or revocation only reaches it once it gets internet access or consumes a fresh offline response. Plan for that before relying on revoking access remotely.

Setting the activation scope

LexActivator's SetProductId() function takes a permission flag that determines where the activation is stored on the machine and which OS users can see it. Two flags apply to node-locked licensing:

LA_USER (the default) stores the activation under the OS user who activated the license, so it is visible only to that user, and each OS user who runs the app activates separately. They all share the same seat. Enable OS user-locked to have each OS user consume a separate seat.
LA_ALL_USERS stores the activation system-wide and shares it across all OS users on the machine.

The permission flag and the userLocked license property are independent and easy to confuse. The flag decides where the activation is stored and which OS users can see it, set in your app's code. userLocked decides whether each OS user consumes a separate seat, set on the license or its template.

LA_ALL_USERS is supported on Windows and macOS. On Linux, achieve the same result by pointing LexActivator at a system-wide directory with SetDataDirectory() and passing the LA_ALL_USERS flag.

LexActivator offers additional flags for services and in-memory storage. See Best Practices for the full list.

Next steps

For the SDK setup, activation calls, and language-specific samples, refer to Using LexActivator.

Subscription Licensing Overview

Last updated: 8/6/2026