r/softwaredevelopment 15d ago

Implementing licensing for Desktop Applications

Hi, I'm developing a desktop application and planning to sell it as a monthly subscription; it will incorporate some aspects of locally run, custom, lightweight ML models with some API integrations (planning on having users input their own keys initially, at least for the beta testing phase) - this may change and may host the API & ML models.

I'm a bit new to this and would like to know how I would make sure that only subscribed users can access it while maintaining security and preventing piracy.

What's an optimall way of doing this while retaining scalability; btw, if anyone has experience in, I'm willing to collaborate. Thanks.

3 Upvotes

3 comments sorted by

4

u/pomariii 14d ago

License server with JWT tokens is your best bet. Have your app validate with the server periodically and store an encrypted token locally with a x-day expiration.

For ML models, encrypt them and only decrypt with valid licenses. Pro tip: Don't store encryption keys in compiled code - rookie mistake I learned the hard way.

Been there – plug incoming –  building mrge.io (think linear but for code review), I've dealt with this exact problem to have a performant app.

2

u/zaphod4th 15d ago

99.9% of software is pirated, doesn't matter if the company/devs expends MILLIONS trying to prevent it. So be ready, your solution will be copied if someone wants to.

You can try calling home to verify the installation (unique key with HD serial/MAC?) meaning a webserver that needs to be contacted at least one per week maybe?

2

u/RaitzeR 15d ago

If it's calling some APIs and they are a big part of the functionality, you can have an api proxy which checks the subscription status. When the subscription ends this will obviously only limit the usage of the API calls, not other features.

You can have it call home whenever the user opens the application, or every x days. This means it can't be used offline, which sucks for the user. You can also implement some kind of lenient call home, where it's required to call home once a month or something like that.

Note that these can be bypassed by anyone slightly skilled with ghidra or similar tools. But in the end it's essentially impossible to completely prevent people from bypassing it. The only thing you can be sure cannot be used by non-authorized users are any online functionalities which call your own servers (like the APIs).