licensing infrastructure

the license layer you don't have to rebuild

every license becomes a cryptographically signed token your customers verify on their own machines — no callback to your servers, and no custom lock to build per product.

  1. 01

    issue

    issue and activate a license key from one core — by sale or by hand.

  2. 02

    sign

    the core mints a paseto v4.public token, signed with the product's ed25519 signing key and chained to your root — never the root key itself.

  3. 03

    cache

    the signed token — carrying the signing certificate and chain to your root in its footer — is cached on the customer's machine at install time.

  4. 04

    verify offline

    the install checks the token against the root key on disk — no network, zero round-trips — and codex_licensed() gates the paid path.

the trust chain

why it holds

security you can explain to a customer

zero round-trips

verify licenses without the internet

customer machines validate licenses against an ed25519 public key already on disk. server outages, network cuts, and air-gapped deployments keep working — the client checks the token against the root key bundled at install, and your servers stay out of the loop.

forgery-resistant certificates

the certificate vouches for the exact key

each signing key ships with a certificate signed by the root. on every verification, codexlab checks that the certificate vouches for the exact signing key that created the token — not just that a certificate exists, but that it's tied to that key. a forged token, or a stolen certificate paired with the wrong key, fails verification immediately.

root never signs tokens

rotate signing keys without breaking customers

the root key stays offline and signs only short-lived signing certificates — never tokens. when a signing key is compromised, you revoke it and issue a new one; cached customer tokens keep validating offline against the root, because the chain in the token footer carries the root's signature. no client re-deployment.

one helper, any framework

codex_licensed() gates the paid path

drop a single function call at the feature boundary. it returns true when the active license includes that entitlement, false otherwise — same shape on wordpress, laravel, anywhere. fail-safe: when offline or revoked, the gate closes. it runs on the customer's server — a commercial lock that deters casual piracy, not a vault for code you ship to the client.

no overclaiming

built to be honest about what it protects

use the client-side lock

codex_licensed()

  • your commercial / billing lock — deters casual piracy
  • one line, the same on wordpress, laravel, anywhere
  • works offline; fails safe the moment a license is revoked

honest limit: it runs on the customer's server, so a determined attacker can patch the check out of the shipped code.

keep it on your server

server-side execution

  • for genuinely high-value logic you can't afford to have cracked
  • the customer never holds the code — the plugin calls your api
  • nothing ships to the client, so there's nothing to patch out

the only real protection for the parts that matter most.

  • every license event and key operation is written to an append-only, hash-chained audit trail, with a daily verify-chain check for tamper-evidence.
  • usage is tracked by stable, non-pii fingerprints — ip and user-agent are optional, retention is configurable, no customer identity baked into the signal.

products

a wordpress adapter and a laravel kit, from one core

the wordpress client ships with the offline verifier and is field-tested on real plugins. the laravel kit is seamed behind http and storage interfaces so the next product reuses the shape. both run the same single signing-key validator, asserted byte-for-byte against the shared source by a kit-generator parity test.

a drop-in plugin with the offline verifier built in — field-tested on real plugins. enter the key on settings → license, then gate features with one line:

// any plugin file
if ( codex_licensed( 'pro_features' ) ) {
    // the paid feature runs
}

gate the server-side effect (rest / ajax / cron), not just the ui — and fail safe.

available now

contact

talk to us before you wire it in

codexlab is pre-launch: the engineering is verified green and field-proven on wordpress, but the crypto stack has not yet had an independent external audit. tell us about your product and your licensing model, and we'll be straight with you about where it's ready and where it isn't.