Electron Licensing

npm install keymint electron-store

import { KeyMint } from 'keymint';
import Store from 'electron-store';

// process.env is only populated in development unless you load it yourself
// (for example with dotenv) or inject the values at build time.
const client = new KeyMint(process.env.KEYMINT_CLIENT_API_KEY!);
const PRODUCT_ID = process.env.KEYMINT_PRODUCT_ID!;
const store = new Store<{ licenseKey?: string; activated?: boolean }>();

export function getHostId(): string {
  return KeyMint.getOrCreateInstallationId();
}

// 401 = invalid, expired, blocked or not allowed on this device;
// 402 = vendor subscription lapsed; 403 = activation limit reached;
// 404 = the product was deactivated or removed.
export function isLicenseRejected(error: unknown): boolean {
  const status = (error as { status?: number } | null)?.status;
  return status === 401 || status === 402 || status === 403 || status === 404;
}

export function getStoredLicenseKey(): string | undefined {
  return store.get('licenseKey');
}

export function isActivated(): boolean {
  return store.get('activated') === true;
}

export async function activateLicense(licenseKey: string): Promise<{
  success: boolean;
  message: string;
}> {
  try {
    const result = await client.activateKey({
      productId: PRODUCT_ID,
      licenseKey,
      hostId: getHostId(),
    });

    store.set('licenseKey', licenseKey);
    store.set('activated', true);
    return { success: true, message: result.message };
  } catch (error: any) {
    return {
      success: false,
      message: isLicenseRejected(error)
        ? error.message
        : 'Could not reach the licensing server. Try again later.',
    };
  }
}

export async function deactivateLicense(): Promise<boolean> {
  const licenseKey = getStoredLicenseKey();
  if (!licenseKey) return false;

  try {
    await client.deactivateKey({
      productId: PRODUCT_ID,
      licenseKey,
      hostId: getHostId(),
    });
    store.delete('licenseKey');
    store.delete('activated');
    return true;
  } catch {
    return false;
  }
}

import { app, BrowserWindow } from 'electron';
import { activateLicense, getStoredLicenseKey } from './license';

app.whenReady().then(async () => {
  const storedKey = getStoredLicenseKey();
  if (storedKey) {
    const result = await activateLicense(storedKey);
    if (result.success) {
      createWindow();
      return;
    }
  }

  // Show activation window — user enters key, calls activateLicense()
  createActivationWindow();
});

function createWindow() {
  const win = new BrowserWindow({ width: 1200, height: 800 });
  win.loadFile('index.html');
}

function createActivationWindow() {
  const win = new BrowserWindow({ width: 480, height: 320 });
  win.loadFile('activation.html');
}

import { contextBridge, ipcRenderer } from 'electron';

contextBridge.exposeInMainWorld('licenseAPI', {
  activate: (key: string) => ipcRenderer.invoke('license:activate', key),
  getStatus: () => ipcRenderer.invoke('license:status'),
});

import { ipcMain } from 'electron';
import { activateLicense, isActivated, getStoredLicenseKey } from './license';

ipcMain.handle('license:activate', async (_event, licenseKey: string) => {
  return activateLicense(licenseKey);
});

ipcMain.handle('license:status', () => {
  return {
    activated: isActivated(),
    licenseKey: getStoredLicenseKey() ? '••••••••' : null,
  };
});

<!DOCTYPE html>
<html>
<body>
  <h2>Activate License</h2>
  <input id="key" type="text" placeholder="A8E2K-9F1BC-3D4GH-7J2KM" />
  <button id="activate">Activate</button>
  <p id="status"></p>

  <script>
    const status = document.getElementById('status');
    document.getElementById('activate').addEventListener('click', async () => {
      status.textContent = 'Activating...';
      const key = document.getElementById('key').value.trim();
      const result = await window.licenseAPI.activate(key);
      status.textContent = result.success
        ? 'License valid!'
        : `Failed: ${result.message}`;
    });
  </script>
</body>
</html>

// From your backend (admin API key required)
await admin.blockKey({
  productId: "YOUR_PRODUCT_ID",
  licenseKey: "A8E2K-9F1BC-3D4GH-7J2KM",
});

export async function checkLicenseHealth(): Promise<'valid' | 'rejected' | 'unknown'> {
  const licenseKey = getStoredLicenseKey();
  if (!licenseKey) return 'rejected';

  try {
    await client.activateKey({
      productId: PRODUCT_ID,
      licenseKey,
      hostId: getHostId(),
    });
    return 'valid';
  } catch (error) {
    return isLicenseRejected(error) ? 'rejected' : 'unknown';
  }
}

// Run periodically (e.g. once per day)
setInterval(async () => {
  if ((await checkLicenseHealth()) === 'rejected') {
    store.delete('activated');
    // Notify renderer to show re-activation dialog
  }
}, 24 * 60 * 60 * 1000);

// From your backend (admin key). Signing also activates hostId on the
// license, so it uses a seat like an online activation.
const offlineLicense = await admin.signKey({
  productId: "YOUR_PRODUCT_ID",
  licenseKey: "A8E2K-9F1BC-3D4GH-7J2KM",
  hostId: "HOST_ID_FROM_THE_MACHINE", // getHostId() on the air-gapped machine
  ttl: 60 * 60 * 24 * 30, // 30 days
});

// offlineLicense.file is the .lic file contents (JSON with the signed JWT)
// Save this file and distribute it to the air-gapped machine

import { jwtVerify, decodeProtectedHeader, importSPKI } from 'jose';
import * as fs from 'fs';

const TRUSTED_KEYS = new Map([
  ['AbC123XyZ', '-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAr7Z8s2Z...\n-----END PUBLIC KEY-----']
]);

export async function verifyOfflineLicense(filePath: string, productId: string, machineCode: string) {
  const fileContent = JSON.parse(fs.readFileSync(filePath, 'utf8'));
  const { signedKey } = fileContent;

  const { kid } = decodeProtectedHeader(signedKey);
  if (!kid) throw new Error('Invalid token: missing kid');

  const pem = TRUSTED_KEYS.get(kid);
  if (!pem) throw new Error('Untrusted key ID');

  const publicKey = await importSPKI(pem, 'EdDSA');
  const { payload } = await jwtVerify(signedKey, publicKey, {
    algorithms: ['EdDSA'],
  });

  // One signing key covers every product in your workspace, so always check
  // the product as well as the machine.
  if (payload.type !== 'offline') throw new Error('Not an offline license');
  if (payload.productId !== productId) throw new Error('Product mismatch');
  if (payload.machineCode !== machineCode) throw new Error('Hardware mismatch');
  return payload;
}