Changelog

A chronological log of features, improvements, and security updates shipped to the Keymint platform.

August 25, 2026

💸 New Pricing: Maker Tier at $12/mo

Introducing the Maker tier — a dedicated $12/mo plan for indie developers and small teams, priced to sit between Free and Startup.

Maker — $12/mo — 150 license keys across 3 products, 5 team members, unlimited customers, templates, and webhook endpoints, plus offline and floating licensing.
Free stays free — 25 license keys, 1 product, 3 team members, no credit card required.
Laddered pricing — Free ($0) → Maker ($12) → Startup ($29) → Standard ($99), so you only pay for the capacity you actually ship.

August 16, 2026

⚡ Monthly API Metering (QUOTA-01)

License keys are now metered. Every activation, heartbeat, checkout, and management call counts toward your plan's monthly API request quota — with visibility built in.

Monthly request quotas — Each plan has a hard monthly cap on API requests, enforced across all your keys and endpoints.
Live usage card — The Analytics page shows exactly what you've used this month: requests left, percent consumed, and the reset date at a glance.
Clear over-limit behavior — When you hit your cap, the card tells you when it resets and points you to upgrading. Free-plan overages are blocked until reset.

🔐 API Key IP Allowlists (SEC-02)

Restrict API keys to trusted networks. When a key has an allowlist, requests are rejected unless they come from one of the listed IP addresses — so a key leaked inside a distributed binary stops working everywhere else.

Per-key allowlists — Attach an allowlist to any API key, with full override and rotation support.
Immediate enforcement — Non-allowlisted addresses receive an explicit rejection, and every attempt is logged for review.

🔔 Slack & Discord Radar Alerts (ALERT-01)

When License Radar flags critical abuse, your team now finds out in seconds — in the chat they already live in.

Slack and Discord channels — Connect either channel with an incoming webhook URL.
Critical-signal alerts — New or re-opened critical fraud signals trigger one alert per signal per hour.
Live preview — The Integrations page shows exactly what your team will see before you connect.
Test & manage — Send a test message, pause, replace the webhook URL, or disconnect at any time.

🚦 Smarter API Rate Limits (RL-01)

The license API now uses token-bucket rate limiting with negative key caching.

Per-action budgets — Rate limits are applied per action (activation, signing, checkin, and friends) with global protection per organization, instead of a blunt per-key ceiling.
RFC 6585 429s — Throttled requests return standard 429 Too Many Requests with Retry-After, so well-behaved SDKs back off correctly.

August 3, 2026

🛰️ License Radar (RADAR-01)

Introducing License Radar, which watches your license keys around the clock and flags activity that looks like sharing or abuse — so you can review it in minutes instead of finding out after lost revenue.

Sees where your keys are used — Radar records details about the devices that activate each key, including location.
Flags suspicious patterns — It automatically brings your attention to keys that look like they're being shared or leaked:
- A single key activating on far too many devices
- A sudden burst of activations in a short window
- One device activating many different keys
Easy review — Suspect activity is grouped into Active / Resolved / False positive tabs so you and your team can work through them at a glance.
Helpful explanations — For each flag, Radar summarizes what happened in plain language and suggests your next step: block the key, take a closer look, or mark it as safe.
Quick actions — Acknowledge or resolve flags in bulk so your review queue stays manageable.

July 13, 2026

🎁 Plan Limits & Feature Gates Reworked

We've restructured plan limits and opened feature gates across every tier.

Team Member Limits — Free: 3 (was 1), Startup: 10 (was 5), Standard: 20 (was 15).
Floating Licensing — Now available on all plans. Concurrent seat management with checkout/heartbeat/checkin flows no longer requires Standard.
Offline / Air-Gapped Licensing — Now available on all plans. Generate signed license files verified with Ed25519 public keys. Offline signing gate also checks that a key pair has been configured, with clear guidance when missing.
Email Delivery — Now available on all plans with no daily cap.
Webhook Endpoints — Unlimited on all plans. Delivery limits: 100/day on Free, unlimited on paid plans.

July 10, 2026

📧 Email Delivery Engine (EMAIL-01)

Introducing the Email Delivery Engine, allowing vendors to automatically send branded license key emails to customers upon key generation.

Managed Delivery or Custom SMTP — Choose between zero-config Keymint-managed delivery or bring your own SMTP server for full control.
Customizable HTML Templates — Design rich HTML email templates with variable interpolation ({{customer_name}}, {{product_name}}, {{license_key}}, etc.) and a live preview editor.
Sender Identity Customization — Configure custom sender name, email address, and subject lines on qualifying plans.
Delivery Triggers — Control whether emails are sent on key generation via the API, the dashboard, or both.

📦 Predefined Product-Level Features (FEAT-01)

Introducing Predefined Product-Level Features, allowing vendors to define standard features at the product level and toggle them on/off when generating or updating keys.

Product Feature Lists — Define standard feature tags (e.g., Pro Mode, API Access, Advanced Analytics) on a product during creation or modification.
Accurate Key Generation & Update — Features are presented as clean checkboxes loaded directly from the product, eliminating manual text entry and typos.
Custom Feature Flags — Continue to support custom, dynamic feature flags added on-the-fly when generating or updating specific keys.

🔐 OAuth & Passwordless Authentication (AUTH-03)

Keymint now supports OAuth sign-in via GitHub and Google, with full lifecycle management for passwordless users.

OAuth Providers — Sign in with GitHub or Google. Accounts are linked by verified email.
Passwordless Account Management — OAuth users can set an initial password, manage passkeys via email OTP verification, and delete accounts without requiring a pre-existing password.
Email-Based Identity Verification — Email OTP fallback for sensitive actions (passkey registration, account deletion) when no password is configured.

👥 Teams Out of Beta

Team collaboration graduate from beta with graduated plan limits and automatic grandfathering for existing members.

Teams Out of Beta — Team collaboration are now generally available. Free plan supports 1 member, Startup supports up to 5, Standard supports up to 15. All existing team members from the beta period are grandfathered in.

June 23, 2026

🔌 Outbound Webhooks Engine (WEB-01)

Introducing Outbound Webhooks, allowing developers to receive real-time HTTP callbacks when key actions occur in Keymint.

Real-Time Callbacks — Receive instant POST alerts on events like license.created, license.activated, license.deactivated, and more.
Cryptographic Signatures — Secure webhook endpoints with auto-generated signature secrets. Deliveries include the Keymint-Signature header calculated using HMAC-SHA256, allowing clients to verify request authenticity.
Reliable Retry Queue — Backed by Upstash QStash, deliveries feature automatic retry queues with exponential backoff on HTTP server errors or network socket resets.
High-Density Webhook Dashboard — Add and configure endpoints, view status indicators, inspect full payload body outputs, and trace delivery logs directly from the vendor settings interface.
Integration Guides — Added complete developer guides in the sidebar documentation, including signature validation snippets.

June 18, 2026

🔐 Client Scope Hardening

Tightened client API key permissions for safer SDK/runtime usage.

GET /key now requires a read-only or admin API key because it returns detailed license/customer data.
POST /key/deactivate now requires hostId when called with a client API key, so client-side credentials can only remove the current device activation.
POST /key/activate now supports an optional licensee object for first-time anonymous license claims without granting broader customer-management permissions.

👥 Multi-Tenant Teams Beta (ORG-01)

Introducing Multi-Tenant Teams Beta — a complete redesign of Keymint's workspace architecture, built to enable secure team collaboration, granular access control, and enterprise-grade tenant isolation throughout our free beta program.

Collaborative Workspaces — Create, manage, and seamlessly switch between multiple isolated team environments, each with its own settings and resources.
Advanced Role-Based Access Control (RBAC) — Delegate responsibilities securely using built-in roles such as Owner, Admin, Developer, and Member, or create fully customized roles with fine-grained permissions.
Streamlined Team Onboarding — Invite collaborators through secure, role-scoped invitation links with automated email workflows, signup validation safeguards, and controlled access provisioning.
Enterprise-Grade Tenant Isolation — Every workspace operates within a strictly isolated boundary, ensuring organization data, licenses, products, analytics, and members remain securely separated.
Centralized Team Management — Manage members, permissions, invitations, and workspace settings from a unified administration experience designed for growing teams.

May 25, 2026

🛡️ Secure Floating License Handshakes (LIC-01)

To protect against concurrent floating seat hijacking and replay attacks, we have introduced a cryptographic challenge-response handshake for floating license sessions.

Temporary Session Secrets — The checkout endpoint now returns a temporary, secure sessionSecret.
Rotating Cryptographic Nonces — Instead of relying on client timestamps and clock drift windows, the server generates and rotates a single-use cryptographic nonce (nextNonce) with every heartbeat/checkin response. Subsequent requests must sign the payload using the latest nonce as the challenge, completely neutralizing replay attacks.
Backward Compatibility — Older clients continue to function using a fallback timestamp verification check if no nonce is present on the session.

🔐 Log Integrity & Immutability (LOG-01)

Hardened audit logging to satisfy strict non-repudiation and database-integrity compliance standards.

Write-Only database triggers — Implemented database-level triggers to guarantee log immutability by rejecting all UPDATE or DELETE commands on the audit and API request log tables.
Expanded query auditing — Updated the tRPC audit log middleware to capture sensitive query read operations (such as retrieving API keys or public keys) to maintain a complete history of reads on sensitive data.

🚫 Strict Build Protections (SDLC-01)

Zero-tolerance build pipeline — Configured the production build pipeline to strictly fail on any TypeScript compilation errors or ESLint warnings to guarantee that only warning-free, correctly compiled code reaches production.

🔑 Asymmetric Key Isolation (CRY-01)

Decoupled database layout — Decoupled Ed25519 signing keys from the main public keys metadata table. The KMS-encrypted private key PEM ciphertexts are now stored in an isolated, dedicated key signing secrets storage table with cascading deletions.

🔐 Administrative Session Hardening

Hardened security compliance by significantly shortening administrative session lifetimes.

Expiration reduction — Reduced session expiration time to 24 hours.
Sliding update — Configured active sessions to require a sliding update within 2 hours of inactivity.

👥 Customer Activation Self-Reset Authorization

Fixed a privilege escalation vector in activation resets:

Self-Service Verification — Enforced the customerCanSelfReset flag server-side. Customer-initiated activation resets are now blocked if the flag is disabled on the license key.

📂 Standardized Data Retention Windows

Aligned user-facing policies with internal automated systems to protect customer privacy.

7-day retention — Standardized the log/PII database deletion cron job to 7 days, matching updates to the Data Processing Agreement (DPA) and ISMS policy.

May 24, 2026

🔑 API Key Expiration & Usage Tracking

API keys now support detailed expiration lifecycles and real-time active tracking.

Configure preset expiration times (30, 60, or 90 days) or select a custom date from a date-picker.
View real-time Last Used and Expires At timestamps directly in the API Keys dashboard list.
Expired keys are rejected instantly at the API gateway layer to prevent credential exposure.

📦 Automated Log Archiving & Retention

Implemented secure log archiving to prevent database storage bloat and ensure historical data preservation.

Daily cron jobs offload API request logs and vendor activity logs older than 90 days.
Logs are archived directly to AWS S3 (with Standard/Glacier transition rules).
Guaranteed data integrity: logs are only purged from the primary SQL database after successful S3 upload confirmation.

May 23, 2026

🔐 Multi-Factor Authentication (MFA)

Keymint now supports multi-factor authentication to strengthen account security.

Enable 2FA from Account Settings
Supports Google Authenticator, Authy, and Microsoft Authenticator
Backup recovery codes generated during setup
Can be enforced at workspace level for added security

🛡️ API Key Scopes

Introduced a new "client" scope for safer SDK and activation workflows.

Isolates client-side operations from admin-level APIs
Prevents access to sensitive read/write endpoints
Strengthens least-privilege enforcement across integrations

May 18, 2026

🚀 Concurrent Floating Licensing

Enterprise-grade floating (concurrent) licensing is now available. License seats can now be shared dynamically across multiple instances instead of being tied to a single device.

Highlights:

Concurrent checkout system with heartbeat-based lease tracking
Automatic session cleanup using cron-based expiry + grace period handling
Real-time visibility of active sessions in the dashboard
Admin tools for force-revoking active leases
Full API support for programmatic floating license creation

May 14, 2026

📊 Analytics Refresh

A major upgrade to the analytics system with improved performance, privacy, and insight depth.

Key improvements:

Non-blocking event logging for zero API latency impact
Automatic masking of sensitive data (keys, credentials, IPs)
Geographic request insights (country, region, city)
Version adoption tracking across products
Redis + QStash-backed reliability layer

Dashboard:

Redesigned high-density activity log
Direct navigation from logs to licenses and products

Fixes:

Fixed analytics grid layout overflow and spacing issues

May 12, 2026

📦 License Key Templates

Reusable key configuration templates are now available.

Save and reuse complex license configurations
Apply templates during key generation
Filter templates by product
Manage and delete saved templates from the UI

May 08, 2026

🖥️ Machine Node-Locking

License keys can now be restricted to specific machines.

Pre-authorize machine codes during key generation
Enforced via allowedHosts in API requests

May 02, 2026

🧪 API Playground & Integrations

Interactive API sandbox and developer snippets are now available for faster integration.

🔑 API Key Scoping

Added admin and read-only scopes for finer permission control.

🎛️ Command Center Redesign

Dashboard redesigned into a minimalist command center with improved layout clarity and faster data access.

April 30, 2026

⚙️ Performance & Infrastructure

Backend improvements for better scalability, stability, and API throughput.

April 10, 2026

🔒 Data Protection Updates

Aligned account deletion grace period (7 days) across UI and privacy policy for consistency.

April 07, 2026

🧩 Host ID Feedback Loop

Activation responses now include hostId in metadata for easier machine identity tracking.

📚 Documentation Updates

Updated developer guides and OpenAPI specs for improved clarity on identity handling.

April 05, 2026

🎨 Design Refresh

A full UI redesign introducing a high-contrast, modern visual system.

✨ UI Improvements

Refined dashboard, homepage, and data tables for a more consistent experience.

Fixes & Improvements

Improved API reliability, tenant isolation, and rate-limit consistency across endpoints.

February 28, 2026

📌 Product Versioning

Products now support versions with independent configuration and lifecycle management.

Assign license keys to specific versions
Manage versions directly from product dashboard

🧭 UI Enhancements

Version selector added to license modal
Version column added to license table

February 17, 2026

🧪 Trial & Feature Flags

Added trial mode and feature flag support for license keys.

Enable trial mode during key generation
Attach feature flags per license
UI badges for trial and feature-enabled keys

🔧 API Enhancements

New endpoints now return enriched metadata including trial and feature information.

Fixes & Improvements

Resolved duplicate modal rendering issues in the license editor.