Reliability
Your customers keep running, even when the license server does not answer.
A licensing API sits on your revenue path. The SDK is built to survive an unreachable server. Today that server is yours: Paperkey runs as an MIT-licensed self-hosted stack, and the managed edition is not open.
Where Paperkey stands
No managed service yet.
There is no hosted API to sign up for, so there is no status page and no uptime figure to publish. The only way to run Paperkey today is the self-hosted edition from the GitHub repository.
Read the self-host guide →72-hour offline grace
Built into the SDK, on by default.
When validate() returns valid:true, the SDK writes the verdict to a local cache. If the next call fails because the API is unreachable (network error, timeout, or 5xx), the SDK replays the cached verdict for up to 72 hours. Revocation, expiration and any 4xx are never cached. A revoked license stays revoked.
- Default 72 h, configurable via gracePeriodMs (max 30 days, 0 disables it).
- Pluggable storage: memoryCache (default), fileSystemCache({ path }), or your own.
- Only positive verdicts are cached.
- License keys are hashed (SHA-256) before being used as cache keys. Raw keys are never written to disk.
import { createClient, fileSystemCache } from '@paperkeyhq/sdk';
const paperkey = createClient({
apiKey: process.env.PAPERKEY_PK!,
baseUrl: 'https://api.example.com',
cache: fileSystemCache({ path: app.getPath('userData') }),
});
const result = await paperkey.validate(licenseKey, fingerprint);
if (result.source === 'cache') {
// Running on the last verified verdict.
// The session continues normally.
}Available since @paperkeyhq/sdk v0.3.0. Point baseUrl at your own instance.
What you run
A small, predictable stack.
No magic. The whole monorepo is MIT-licensed, and the self-host recipe is intentionally boring: one Postgres database, the API, the dashboard, and a reverse proxy, all in Docker on a single server.
- Caddy at the edge: Let's Encrypt certificates, HTTP/2 and HTTP/3, security headers.
- Postgres 16 on an internal network, never exposed. The guide includes a pg_dump cron for backups.
- Webhooks signed with HMAC-SHA-256, 5-second timeout, auto-pause after 10 consecutive failures.
- Dashboard auth via an httpOnly session cookie. Public API via Bearer keys, with per-IP rate limits.
- No telemetry and no phone-home. Your license data stays on your server.
Zero lock-in
Nothing to escape from.
You run the code, you own the database. The escape hatches are the code itself.
- MIT-licensed SDK: @paperkeyhq/sdk on npm. Fork it, vendor it, or point its baseUrl at any compatible backend.
- Export from the dashboard or the API: every license and activation per product, as CSV or JSON.
- MIT-licensed monorepo: API, dashboard, SDKs and MCP server. No feature is gated in self-host mode.
Honest list
What we do not claim.
A licensing provider that overstates its posture is a liability.
- No managed service, no SLA, no public status page. None of these exist yet.
- No SOC 2 or ISO 27001. A fake badge would not help anyone.
- No PCI scope. Paperkey does not process payment cards. It only issues and validates licenses.
- No "trusted by" badge and no customer logos.
Questions about running Paperkey?
Email a real person, or open an issue on GitHub.
The managed edition is not open yet
Leave your email to hear when it opens. There is no date. The self-hosted edition runs today, under the MIT license.