License keys for your app, running free on Cloudflare Workers.
Issue, validate and revoke keys with a small TypeScript Worker you own. Deploys in 5 minutes. No monthly fee, no servers, no dependencies.
The problem
Selling a desktop app, CLI, plugin or template means you need keys: generate one per sale, check it in the app, stop honoring refunds. Hosted services charge about $29 a month for that. Self-hosted PHP kits want a server to babysit. Rolling your own means a weekend of crypto and edge cases.
How it works
1. Deploy
Create a KV namespace, set three secrets, wrangler deploy. Fits the Workers free tier.
2. Sell
Point a Gumroad Ping or Lemon Squeezy webhook at the Worker. Each sale creates a key; refunds revoke it.
3. Check
Paste the JS, Python or Go snippet into your app. Signed responses are verified offline and cached.
$ curl -X POST https://licenses.example.workers.dev/v1/validate \
-d '{"key":"KB-7K2XM-9QF3T-0ABCD-HJ4WZ","product":"my-app"}'
{"valid":true,"reason":"ok","expires_at":null,"activations_left":2,
"payload":"{...}","sig":"mV3...","alg":"ed25519"}
What you get
Activation limits
Per-machine instance IDs, activate and deactivate, expiry dates.
Signed responses
Ed25519 or HMAC, so apps verify offline and ignore a spoofed server.
Sales webhooks
Gumroad and Lemon Squeezy, idempotent, with automatic refund revocation.
Admin page
Create, look up and revoke keys from a single built-in page.
Safe storage
Only the SHA-256 of each key is stored. Buyer emails are kept as hashes.
Tested
Vitest suite running in a real Workers runtime. About 6 KB gzipped, zero runtime dependencies.
Lite vs Pro
| Feature | Lite | Pro |
|---|---|---|
| Create keys (admin API) | Yes | Yes |
| Validate keys, expiry | Yes | Yes |
| Revoke, lookup, list | - | Yes |
| Activation limits | - | Yes |
| Signed responses, offline verify | - | Yes |
| Gumroad + Lemon Squeezy webhooks | - | Yes |
| Admin web page | - | Yes |
| JS / Python / Go clients | - | Yes |
| Test suite | - | Yes |
| License | MIT | Commercial, unlimited own projects |
Pricing
FAQ
Is this DRM?
No. License keys deter casual sharing and let you honor refunds. Someone who controls the machine can always patch a client. Treat it as a licensing tool.
Will it really stay free?
Validation is one KV read and no writes. Writes happen only on create, first activation and revoke, well under the free tier's 1,000 writes per day for a small indie product. Check Cloudflare's current limits before you rely on this.
Do I need Gumroad or Lemon Squeezy?
No. The admin API creates keys from any checkout, script or spreadsheet. The webhooks are a convenience.
How do buyers receive their key?
Neither platform emails a webhook response. You look the key up with an admin call by sale ID, or send it from your own fulfilment script. The README explains both.
Can I use it for several products or clients?
Yes. The commercial license covers unlimited projects of your own or your clients'. You may not resell or redistribute the kit itself.
Refunds?
Handled by Gumroad under their policy. The Lite version lets you try the basics first.