Overview
Signox is a software License Management SaaS. When you issue a product license from the dashboard, the Signox SDK embedded in your app validates and activates that key.
Domain Model
Section titled “Domain Model”| Concept | Description |
|---|---|
| Product | The software product you issue licenses for. Each product has its own signing key pair |
| Policy | Issuance rule template — license type (perpetual/timed/trial), device limit, VM policy, grace period, feature values |
| License | An individual license issued from a policy. The licenseKey is the sole credential |
| Device | A device the license is activated on. Identified by hardware ID (hwid) |
| Feature | A feature holding a value (bool/int/string). The value is determined only by the policy |
Core Design Principles
Section titled “Core Design Principles”1. The key is the credential
Section titled “1. The key is the credential”All you need to validate and activate is the license key. No separate API token is embedded in the app — because a secret token shipped inside distributed software can be extracted.
2. Hardware-locked (node-locked)
Section titled “2. Hardware-locked (node-locked)”Every license is locked to a device. A license key alone does not authenticate; it must be paired with the device identifier (hwid) generated by the SDK. The number of concurrent seats is controlled by the policy’s maxDevices.
3. Signed responses (Ed25519)
Section titled “3. Signed responses (Ed25519)”Every license state is delivered signed with the product-specific key, and the SDK verifies it automatically against the embedded public key:
- a proxy or man-in-the-middle cannot forge a response to bypass the license, and
- opening product B with product A’s key is cryptographically prevented (product binding).
There is nothing to worry about in your integration code — the SDK does all of it.
4. Identical output online and offline
Section titled “4. Identical output online and offline”There is a single key (licenseKey). Online and offline differ only in how you obtain the signed license state stored locally; the result is identical. Air-gapped offline is always supported with no extra configuration.
How to Integrate
Section titled “How to Integrate”You integrate via the SDK — released in the order Node.js → Java → C#. Since the SDK handles device identification, signature verification, offline validation, and local caching, integration takes just a few lines of code.
If you need support for a language or platform the SDK does not cover yet, please reach out.