Skip to content
License Server v1.29.0 · released 30 Oct 2026release notes →
Casazium
Casazium

License Server ​

License Server issues license keys to your customers, tells your app whether a key is valid, and tracks which machines have activated it. It can also gate your release downloads behind a valid license and deliver keys automatically when a storefront sale completes.

You can use it as a hosted account, or run the same software on your own infrastructure. This documentation covers both.

Two halves ​

You manage licenses in the consoleYour app talks to the API, through the SDK
Issue a license, find a customer's, change its terms, revoke it, free a seat. On a hosted account, also connect a storefront, manage your plan and your API key. See Using the Console.Activate a key on a machine, verify it at launch, track usage, check for updates. The JavaScript SDK does this in a few lines, and any language can call the API directly. See the Integration overview.

Whatever you do to licenses in the console, the API can do too, so scripts and back-office systems can issue them as well (see Automating this with the API). Admin calls need your API key and belong on a server you control. Activation and verification are public, because a license key has to travel with the app it licenses. Rate limits vary by kind of call: see Rate Limits.

Hosted or self-hosted ​

  • Hosted: a managed account. Sign up, then work in the console at license-cloud.casazium.com. See Hosted (SaaS) Tier.
  • Self-hosted: the same server in a container on your own infrastructure. The self-hosted bundle includes the same console. See Installation.

Both run the same server and the same API, so nothing you build has to change if you move between them. Pricing lays out the differences side by side.

Your API address

The examples use https://your-license-api.com as a stand-in for your License Server's API address. Put yours in its place:

  • Hosted account: https://license-cloud-api.casazium.com. The console's Settings → API access → API base URL shows it with /v1 already on the end, https://license-cloud-api.casazium.com/v1, so that value replaces https://your-license-api.com/v1 as a whole: don't add a second /v1. Not license-cloud.casazium.com: that's the console, and an API call sent there gets a JSON 404 naming the right address. Where an example sends $ADMIN_API_KEY, use your account's API key from the same Settings → API access section instead: a hosted account doesn't accept ADMIN_API_KEY.
  • Self-hosted: your own server's address. The self-hosted bundle answers on http://localhost:3001 on the machine running it, so http://localhost:3001/v1 replaces https://your-license-api.com/v1.

Start here ​

Quick start (hosted) ​

From sign-up to a first activation.

1. Sign up and issue a license. Create an account at license-cloud.casazium.com/signup. You land on Issue your first license. Fill in Product ID, Tier and Issued to, leave the rest as it is, and choose Issue my first license.

2. Copy three values.

  • The key, shown on the "License issued" page. This is what your customer enters in your app.
  • The Product UUID, shown under the key. It's the same for every license with this Product ID, so your app can hard-code it.
  • Your API address, from Settings → API access → API base URL: https://license-cloud-api.casazium.com/v1. This is not the address of the console you're signed in to (license-cloud.casazium.com); your app sends its requests to the API address.

3. Activate it from your app with the SDK, with baseUrl set to that API address:

bash
npm install @casazium/license-sdk

The SDK is an ES module, and this snippet uses top-level await, so run it as an ES module: a .mjs file, or "type": "module" in your package.json.

js
import { CasaziumLicenseClient } from '@casazium/license-sdk';
import { getFingerprint } from '@casazium/license-sdk/fingerprint';

const client = new CasaziumLicenseClient({
  baseUrl: 'https://license-cloud-api.casazium.com/v1',
});

const key = 'the-key-from-step-2';

// Takes a seat on this machine. Save `token`: it's needed to deactivate
// this machine later, and it's returned only once.
const { activated, token } = await client.activate(key, getFingerprint());

// Checks the license, and that it belongs to your product.
const result = await client.verifyKey(key, 'your-product-uuid');
if (result.valid) {
  console.log('License is valid');
}

Back in the console, the license's page now lists this machine under Activations. License Activation and License Verification cover the rest: launch checks, offline use and freeing a seat.

The same calls without the SDK (curl)

A health check uses the address without /v1 (hosted: https://license-cloud-api.casazium.com/):

bash
curl https://your-license-api.com/

Response:

json
{
  "message": "License API is running",
  "version": "1.0.0",
  "buildFingerprint": "a1b2c3d4e5f6"
}

Verify a key:

bash
curl -X POST https://your-license-api.com/v1/verify-license \
  -H "Content-Type: application/json" \
  -d '{
    "key": "7yChyZcfMG23Dx1sjBoLziPFrH4n-6f28"
  }'

Activate it on one machine:

bash
curl -X POST https://your-license-api.com/v1/activate-license \
  -H "Content-Type: application/json" \
  -d '{
    "key": "7yChyZcfMG23Dx1sjBoLziPFrH4n-6f28",
    "instance_id": "server-001"
  }'

See it working ​

The License demo is a small open-source Electron app that uses a live demo server: get a free test key from inside it, activate, go offline, try a revoked key. Every API call it makes is shown next to its result.

Key Concepts ​

License Key Format ​

  • Old Format (UUID): a1b2c3d4-e5f6-4789-9012-345678abcdef
  • New Format (Base58): 7yChyZcfMG23Dx1sjBoLziPFrH4n-6f28

New Key Format Benefits

  • 160 bits of randomness before the dash, vs UUID's 122 bits (the 4 characters after the dash add 16 more)
  • No confusing characters before the dash (Base58 excludes 0, O, I, l); the 4 characters after it are lowercase hex, so they can include 0
  • Shorter length for better usability

Every part of a key is random. Nothing in it encodes the tier or the product, so a key can't be checked from its text alone: verify it with the server, or with an offline license file.

Authentication ​

Two levels of access — see Authentication for the details:

  • Public endpoints, such as activate and verify, need no API key: the license key travels with your app.
  • Admin endpoints (issue, revoke, list) need a Bearer token: your account's API key on a hosted account, or ADMIN_API_KEY self-hosted. The console makes these calls for you.

Documentation Sections ​

Need Help? ​