Licensing via Web API

We strongly recommend using the LexActivator library for licensing. Use the Web API for license activation only if LexActivator is not available for your OS.

Prerequisites

After you have added a product for your app in the admin portal, go to that product's page. You will need to do two things:

Note the product id.
Download the RSA public key for the product.

The RSA public key is needed to verify the signature of the activation token you receive on activating a license. The product id identifies the product to be licensed.

The license's fingerprintMatchingStrategy applies only to fingerprints generated by a Cryptlex SDK, so it is ignored when you license through the Web API.

Activation lifecycle

Once setup is complete, your app manages the license through the following calls.

Activating the license

To activate the license in your app using the license key, send a POST request to the create activation endpoint. Refer to the POST /v3/activations reference for endpoint details.

On successful activation, the endpoint returns an activation token. The activation token is a JWT, so you can verify its signature using any JWT library available for your language. You can then parse the JWT activation token to get the license details.

If your product uses feature entitlements, note that they are not part of the activation token. Fetch them separately by sending a GET request to the GET /v3/activations/:id/feature-entitlements endpoint, passing accountId and licenseId as query parameters.

Verifying license activation

Each time your app starts, verify whether the license is already activated. This verification should happen locally by verifying the signature of the JWT activation token using the RSA public key.

Storing the JWT activation token and feature entitlements in encrypted form is recommended, though not required unless the token contains sensitive metadata.

Once the signature is verified, parse the token to read the license details.

If the license has feature entitlements linked, the feature entitlements response is also a signed JWT. Verify its signature with the same RSA public key, then parse it to read the entitlements.

Syncing license activation

To sync the client changes with the server and vice versa, send a PATCH request periodically to the update activation endpoint. You can decide the sync frequency yourself, or use the sync interval set for the license (available in the JWT activation token). If you choose the latter, you can control it from the admin portal. Refer to the PATCH /v3/activations/:id reference for endpoint details.

If your product uses feature entitlements, fetch them again from the GET /v3/activations/:id/feature-entitlements endpoint after each sync, since they may have changed on the server.

Deactivating a license

To deactivate the activation on the machine, send a POST request to the deactivate activation endpoint. Refer to the POST /v3/activations/:id/deactivate reference for endpoint details.

Authenticating users

For user-based flows such as named user licensing, authenticate the user with the login endpoint to obtain an access token. With that token you can call user-scoped endpoints on behalf of the user, such as fetching their licenses via the /v3/me/licenses endpoint, or build a custom self-service experience instead of the customer portal.

API Endpoints Proxies and Firewall

Last updated: 7/13/2026