Hosted license keys for indie software sellers

The idea

Every indie developer selling a Mac app, a Figma or Obsidian plugin, or a small game rebuilds the same licensing plumbing: generate keys on purchase, validate them in the app, cap activations, revoke on refund. It is pure undifferentiated work, and the home-rolled versions are reliably bad, plaintext keys, no revocation, validation that dies when the seller’s server does.

Keygen proves people pay real money for this, but it is an enterprise-shaped platform with policies, entitlements and a steep API. The wedge is radical simplicity: one webhook in from Stripe or Lemon Squeezy, one activate endpoint out, signed licenses that verify offline. The offline-capable signature is the detail that matters, desktop apps cannot phone home on every launch, and it is exactly the part indie devs get wrong alone.

Who pays

The buyer is an indie developer already making sales through Stripe or Lemon Squeezy who wants licensing solved in an afternoon. Flat 19 dollars a month (free to 50 keys) beats both Keygen’s complexity and a revenue-share model for anyone with real volume, and the no-percentage pitch is the differentiator. Distribution: Electron, macOS dev, Figma and Obsidian plugin communities, SEO on license key api and stripe license key generation, and docs good enough to rank on the integration queries.

MVP scope

• Stripe and Lemon Squeezy purchase webhooks generating and emailing keys
• Activate/validate endpoint returning Ed25519-signed licenses for offline verification
• Device-count limits with deactivation and per-key overrides
• Automatic revocation on refund or dispute
• Dashboard with key search by email for support workflows
• Skip for v1: floating/seat licenses, trials and metered entitlements, native SDK packages, Paddle/Gumroad sources, usage analytics

Build KeyPost, a hosted licensing API for indie software sellers. Stack: Next.js (API routes plus dashboard), Postgres, Stripe both for KeyPost's own billing and as the first supported payment webhook source.

Core flow: seller creates a product in the dashboard, sets a device limit (e.g. 3 activations), and pastes KeyPost's webhook URL into Stripe or Lemon Squeezy. On checkout.session.completed (or the Lemon Squeezy equivalent), KeyPost generates a key (XXXX-XXXX-XXXX-XXXX, Crockford base32, no ambiguous characters), stores it against the buyer's email, and either emails it directly or returns it via API for the seller's own receipt flow. On charge.refunded or dispute, the key is revoked automatically.

The integration surface is deliberately tiny: one validate endpoint, POST /v1/activate with key plus a device fingerprint, which returns a signed JSON license (Ed25519 signature, the product's public key downloadable from the dashboard) with an expiry-of-signature window. Apps verify the signature locally, enabling offline validation between periodic re-activations; document the 10-line verification snippet for Swift, Node/Electron and C#. Device limits enforced at activation with a deactivate endpoint so users can move machines; sellers can raise limits per-key in the dashboard for support cases.

Pages: landing with the full integration shown in one screen, dashboard (products, keys with search by email, activations, revocations), per-product settings and public key, docs, billing.

Pricing: free to 50 keys, then 19 GBP/month unlimited, no revenue share.