What's built, what's next

Full monorepo on github.com/paperkeyhq/paperkey. MIT-licensed, single Docker compose, zero telemetry. Same SDK and API as the managed version. See /self-host.

@paperkeyhq/sdk on npm. Validate, activate, deactivate. MIT-licensed and audit-friendly.

Drop @paperkeyhq/mcp into your AI client and drive Paperkey from natural language. Stdio transport, dashboard JWT auth.

Six events for license + activation lifecycle. SHA-256 signing, 5-second timeout, auto-pause after 10 consecutive failures.

Auto-generated integration spec the LLM reads to wire Paperkey end-to-end. Point Cursor, Claude Desktop or an n8n flow at it.

Bind a license to a device fingerprint. In SDK v0.3 (in the repo, not yet on npm), validate() caches the last positive verdict on disk and replays it for up to 72 hours when the API is unreachable, so your customers keep running when your server is unreachable.

TOTP + 10 single-use recovery codes on dashboard accounts, optional. An email goes out on every 2FA change and on account deletion.

In the monorepo (packages/sdk-python). Sync + async client, same surface as the TS SDK, cross-language HMAC test vector, 72 h offline grace. Not published on PyPI yet.

In the monorepo (packages/sdk-php). PHP 8.1+, Guzzle HTTP, readonly DTOs, PHPStan level 9, HMAC test vector aligned with TS / Python. Not published on Packagist yet.

Multi-user dashboard with roles (owner / admin / viewer). Audit log enriched with actor and team. Every account also gets a personal team.

Not open yet, no date. The waitlist on the homepage sends one email when it opens.

Stripe Checkout + Customer Portal are built in the codebase (Free, Pro, Business, grace period on cancel). They go live with the managed edition.

Pro and Business tiers can extend the 90-day default to 1 year for compliance.

Self-hosters could skip the build step. The publishing workflow for ghcr.io/paperkeyhq/api is in the repo, no image is published yet.

One-click flows for "issue license on Stripe payment", "revoke on refund", "send onboarding email on activation".

Bring your own SMTP and From address for the license-issued email. For when "from @paperkey.dev" is not on-brand for your customers.

A single key unlocks several products. Useful for bundles or upgrades from a base SKU to an add-on.

For the self-host crowd that wants click-not-curl. A button per platform that provisions the stack.

For CLI tools and Go-based plugins. Would land if there is community pull.

The REST API covers 95 % of cases. GraphQL would only land if a real customer use case shows up.

For enterprise sales. Would arrive with a Pro+ tier and per-seat pricing tweak.

Run the dashboard on your own subdomain (app.yourbrand.com). Caddy on-demand TLS, branded login. Needs paying-customer demand first.