Offline Licenses

When a machine has no internet access at the time of activation, your app cannot reach the Cryptlex servers directly. Instead, you activate the license offline by exchanging files through the admin or customer portal.

How offline activation works

Your app generates a request file. The user enters their license key, and LexActivator writes an offline activation request file that identifies the license and the machine.
The request is exchanged for a response. You (or your customer) upload the request file on the admin or customer portal from any machine that has internet access, such as a phone, laptop, or edge device. The portal validates it and returns an offline activation response file that is valid for a limited period.
Your app consumes the response. LexActivator reads the response file to activate the license on the offline machine and stores the activation on disk in encrypted form.

Once activated, your app verifies the license locally on every start, with no internet access required. For a time-bound license, LexActivator returns the LA_EXPIRED status when the license expires, which your application should handle based on your business requirements.

While the machine has no connection, nothing you change on the license reaches it. Renewals, suspension or revocation, entitlement changes, and updated metadata all apply only once the machine completes a server sync or consumes a fresh offline activation response. Take that into account before relying on remote changes to an offline license.

What the offline request file contains

The request file that GenerateOfflineActivationRequest() writes is an encrypted blob, not human-readable. Its payload is essentially the same JSON an online activation sends to the Cryptlex servers, identifying the license and the machine:

{
"licenseKey": "XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX",
"productId": "63dfd63e-ed71-4f84-9236-02ee0ddb062c",
"fingerprint": "<machine fingerprint hash>",
"releaseVersion": "1.4.2",
"os": "windows",
"metadata": {},
...
}

The response file the portal returns is an encrypted, signed token with a validity window (see Creating the activation response). LexActivator verifies the signature and confirms the machine's current fingerprint still matches before activating, so the activation cannot be moved to another machine.

Generating the activation request

The user enters their license key, and your app generates the offline activation request file at the path you pass to the function:

SetLicenseKey("LICENSE_KEY");
GenerateOfflineActivationRequest("REQUEST_FILE_PATH");

GenerateOfflineActivationRequest() creates the request file at the path you provide, so the path must include the file name.

Creating the activation response

Take the request file to any machine with internet access. In the admin portal, open the Activations page, click CREATE OFFLINE, upload the offline activation request file, set the validity of the response file, and click ACTIVATE. If the request is valid, the offline activation response file can be downloaded.

The response file is valid only for the period you set, so it must be consumed on the offline machine before that period expires. On the admin portal you can configure this validity; on the customer portal it is fixed at 3 days.

Response validity is not the same as the license's expiration date. The expiration date is set on the license itself and enforced after activation as usual. Keep the response validity as short as your delivery workflow allows, since the file stays consumable on that machine for the full window.

An expired response file cannot be revived. If the validity period lapses before the offline machine consumes it, generate a new offline activation request on that machine and exchange it for a fresh response.

Your customers can also log in to the customer portal and download the response file themselves, which saves you time on product support. This is useful when the offline machine is isolated but the customer has internet access on another device.

Automating the activation response

Besides the portals, you can generate the response programmatically through the POST /v3/activations/offline-activate endpoint, which is useful for building your own tooling, such as an internal utility a service engineer runs on a connected laptop. The request body takes the licenseId, the content of the offline activation request file as offlineRequest, and the responseValidity in seconds. The endpoint identifies the license by licenseId, not by its key; if your tooling only has the license key, resolve the ID first with a GET /v3/licenses?key=<licenseKey> lookup.

The endpoint requires a Web API access token. Never embed the token in an application you ship to customers; call the endpoint from your own backend or an internal tool instead. See personal access tokens.

Activating with the response

Move the response file to the offline machine and let your app consume it from the path you pass to the function:

ActivateLicenseOffline("RESPONSE_FILE_PATH");

ActivateLicenseOffline() consumes the response file at the path you provide, so the path must include the file name.

LexActivator persists the activation on disk in encrypted form. On every application start, it verifies the stored activation and confirms that the machine's current fingerprint still matches the fingerprint recorded in the activation data, so the license cannot be moved to another machine.

Deactivating offline

To free a seat from a machine without internet access, generate an offline deactivation request at the path you pass to the function:

GenerateOfflineDeactivationRequest("REQUEST_FILE_PATH");

This invalidates the local license data and writes an offline deactivation request file, which the user sends to you. To release the seat, delete the corresponding activation from the Activations page in the admin portal.

Controlling deactivations and transfers

For licenses that are activated offline, treat machine transfers as a deliberate, support-driven step rather than a self-service one:

Set Allowed Deactivations to 0 on the license, and raise it only when a customer legitimately requests a transfer to another machine. This keeps the number of transfers under your control.
Keep the response validity short, as described above, so an issued response file cannot be consumed long after it was generated.
Route deactivation by activation mode. If your app supports both online and offline activation, call GetActivationMode() to determine how the license was activated: use DeactivateLicense() for online activations and GenerateOfflineDeactivationRequest() for offline ones, so each activation is released through the flow it was created with.

Offline floating licenses

Offline activation applies to node-locked licenses. A hosted floating license is not suitable for offline machines, because its lease must be renewed against the Cryptlex servers and the activation is removed when renewal fails. For floating licensing inside an offline network, deploy LexFloatServer on the customer's premises.

For on-premise floating deployments, borrowing works differently, through LexFloatClient. See Borrowing a license for offline use.

Feature-Based Licensing Software Maintenance and Support

Last updated: 9/14/2026