Choose where your application must enforce access before choosing a language or credential.
What you will learn
- Which process should activate and validate a license.
- Which starter guide matches your application.
- Where secret management credentials are allowed.
Prerequisites
- Read the introduction.
- Know whether the protected operation runs on your server or the customer's machine.
Choose by application
| Your application | Enforcement location | Begin here |
|---|---|---|
| Desktop app | Application process; Electron main process for JavaScript | Desktop architecture and quickstart |
| SaaS backend | Your authenticated server, before protected actions | SaaS architecture and PHP setup |
| CLI or developer tool | Tool process with protected local state; server checks for online resources | CLI architecture and Python setup |
| Plugin or extension | Plugin process for local features; your backend for valuable online operations | Plugin architecture and authentication |
Choose by language
- Python 3.9+: Python quickstart.
- Node.js 18+ or Electron main process: JavaScript quickstart.
- PHP 8.2+ with cURL and Sodium: PHP quickstart.
- C# with .NET 7+ source compatibility: C# quickstart.
- Another language: start with the cURL transport check and the activation flow. A transport check is not a complete signed/offline client.
Choose by responsibility
If you develop the application, implement signed validation and feature gating. If you operate the sales backend, use a scoped developer API key for license management after confirmed purchases. If you support customers, use the dashboard to inspect a license and its devices instead of asking for passwords.
A browser-only feature check does not protect your SaaS backend. A customer-controlled plugin host is not your trusted management server.
Expected result
You have one starting guide and know where activation tokens, installation state and developer API keys belong.
Common mistakes
- Running the JavaScript SDK in browser code: use Node or Electron main, or your authenticated backend.
- Using an environment switch to migrate a license: Sandbox and Live records are separate.
- Assuming every listed REST language has a maintained SDK: four official SDKs exist; other languages need a conforming client.
Security notes
Check the known SDK limitations before choosing a production architecture. Runtime minimums describe source compatibility, not ongoing security support from the runtime vendor.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Your app has both desktop and SaaS features | Enforcement occurs in two places | Gate local actions locally and authenticate/authorize online actions on your backend |
| Your language has no official SDK | REST support is distinct from an SDK | Implement HTTPS/JSON plus signed semantic checks; do not copy only transport code |
| The application must never connect | Online-first activation does not fit | Confirm requirements with support before purchase |
Next steps
Run the quickstart and review use cases.