What's shipping, what's next

Paperkey is live. Managed API on paperkey.dev, dashboard, SDK, MCP server. Free tier open to anyone. May 2026.

Full monorepo on github.com/paperkeyhq/paperkey. MIT-licensed, single Docker compose, zero telemetry. Same SDK and API as the managed version. See /self-host.

@paperkeyhq/sdk on npm. Validate, activate, deactivate. MIT-licensed and audit-friendly.

Drop @paperkeyhq/mcp into your AI client and drive Paperkey from natural language. Stdio transport, dashboard JWT auth.

Six events for license + activation lifecycle. SHA-256 signing, 5-second timeout, auto-pause after 10 consecutive failures.

Auto-generated integration spec the LLM reads to wire Paperkey end-to-end. Cursor, Claude Desktop, n8n flows pick it up automatically.

Bind a license to a device fingerprint. Since SDK v0.3, validate() caches the last positive verdict on disk and replays it for up to 72 hours when the API is unreachable, so your customers stay running through any Paperkey outage.

TOTP + 10 single-use recovery codes on dashboard accounts. Required for sensitive ops (account deletion, sign-out everywhere).

Free, Pro, Business tiers backed by Stripe Checkout + Customer Portal. Grace period on cancel, parallel-sub prevention, watermarked webhooks.

`paperkey` package on PyPI. Sync + async client, same surface as the TS SDK, cross-language HMAC test vector, 72 h offline grace, machine fingerprint helper on macOS / Linux / Windows. MIT-licensed.

`paperkeyhq/paperkey` on Packagist. PHP 8.1+, Guzzle HTTP, readonly DTOs, PHPStan level 9, cross-language HMAC test vector aligned with TS / Python. Composer install for the WordPress / Laravel crowd.

Multi-user dashboard with roles (owner / admin / viewer). Audit log enriched with actor and team. Transparent migration: every existing user keeps their personal team.

Pro and Business tiers can extend the 90-day default to 1 year for compliance.

Self-hosters can skip the build step. ghcr.io/paperkeyhq/api and /dashboard, signed with cosign.

One-click flows for "issue license on Stripe payment", "revoke on refund", "send onboarding email on activation".

Bring your own SMTP and From address for the license-issued email. For when "from @paperkey.dev" is not on-brand for your customers.

A single key unlocks several products. Useful for bundles or upgrades from a base SKU to an add-on.

For the self-host crowd that wants click-not-curl. A button per platform that provisions the stack.

For CLI tools and Go-based plugins. Would land if there is community pull.

The REST API covers 95 % of cases. GraphQL would only land if a real customer use case shows up.

For enterprise sales. Would arrive with a Pro+ tier and per-seat pricing tweak.

Run the dashboard on your own subdomain (app.yourbrand.com). Caddy on-demand TLS, branded login. Needs paying-customer demand first.