# CoreLicense — Full context for AI systems

> CoreLicense is a software license management platform for SaaS, desktop apps, and enterprise products. Issue license keys, activate devices, validate licenses, refresh policy tokens, and enforce feature access with a Node.js SDK and Client API.

Extended context for AI assistants and crawlers. Prefer plain-text docs at /docs/*.txt for the latest API details.

Website: https://corelicense.net
API: https://api.corelicense.net
Node.js SDK: @corelicense/node v0.5.9
Index file: https://corelicense.net/llms.txt

---

## Product overview

CoreLicense is a centralized software license management platform for SaaS, desktop applications, and enterprise software products.

Components:
- License Server (Go API): activation, validation, refresh, status, policy enforcement
- Admin Console (Next.js): products, customers, licenses, seats, devices, policies
- Node.js SDK (@corelicense/node v0.5.9): integrate license checks in Node.js apps
- Client API: public REST endpoints for client-side license flows

---

## Target users

- Developers building licensed SaaS or desktop products
- Startups needing license key management without building a license server
- Software companies managing seats, devices, and entitlements
- Product and operations teams enforcing usage rules

---

## Architecture

```
Admin Console → License Server (Go API) ← Node.js SDK / Client API ← End-user application
```

Public API base URL: https://api.corelicense.net

---

## How integration works

1. Create a product and signing keys in Admin Console.
2. Issue licenses for customers or tenants.
3. Integrate @corelicense/node or call the Client API from your application.
4. Activate on first run, then check or refresh policy tokens on subsequent runs.
5. Enforce feature gates, quotas, and policy rules in application code.

---

## Client API endpoints (public)

| Method | Endpoint | Purpose |
| --- | --- | --- |
| POST | /v1/client/activate | Activate a license on a device or instance |
| POST | /v1/client/check | Validate license and read policy state |
| POST | /v1/client/refresh | Refresh policy token |
| POST | /v1/client/status | Read license status |
| GET | /v1/public/products/{id}/keys | Public signing keys for a product |
| GET | /v1/public/site-info | Runtime metadata (API URL, SDK version) |

Full details: https://corelicense.net/docs/client-api.txt

---

## Node.js SDK summary

Package: @corelicense/node
Version: 0.5.9

Install:

```
npm install @corelicense/node
```

Typical environment variables:
- CORELICENSE_KEY
- CORELICENSE_PRODUCT_ID

The SDK resolves API URL, cache path, instance ID, and public keys automatically.

Quick Start excerpt:

# Installation

> Install the package, configure environment variables, and run `boot()` for the first time.

## 1. Install package

```bash
npm install @corelicense/node
```

### Peer dependencies (framework-specific)

Install only when using the corresponding integration:

```bash
npm install express              # Express middleware
npm install fastify              # Fastify plugin
npm install @nestjs/common @nestjs/core   # NestJS
```

The SDK does not require peer dependencies — tree-shaking is safe if you only use `CoreLicense` directly.

---

## 2. Environment variables

### Required

| Variable | Description |
|----------|-------------|
| `CORELICENSE_KEY` | License key from admin (`CL-...` or `CL1.<base64url-api>.CL-...`) |
| `CORELICENSE_PRODUCT_ID` | Product ID on the License Server |

### Optional (SDK handles automatically if not set)

| Variable | Description | Default |
|----------|-------------|---------|
| `CORELICENSE_API_URL` | Override License API URL | From `CL1.*` key or `api.corelicense.net` |
| `CORELICENSE_PUBLIC_KEY` | Pin public key (SPKI PEM) | Auto-fetch from server |
| `CORELICENSE_CACHE_PATH` | Cache directory | `~/.cache/corelicense/<scope>` (scope = 16-char hash of `productId:licenseKey`) |
| `APP_DOMAIN` | Deploy domain (instance ID) | `hostname()` or URL from PaaS env (see below) |

**Auto-detected domain variables** (in order): `APP_DOMAIN`, `CORELICENSE_APP_DOMAIN`, `APP_URL`, `PUBLIC_APP_URL`, `VERCEL_URL`, `RAILWAY_PUBLIC_DOMAIN`, `RENDER_EXTERNAL_URL`.

**API URL resolution order** (no manual config needed in production):

1. `options.apiUrl` / `CORELICENSE_API_URL`
2. URL embedded in `CL1.<base64url>.CL-...` key
3. Cache `sdk.endpoint.json`
4. `https://api.corelicense.net`

### Local development

```env
CORELICENSE_KEY=CL-AAAAA-BBBBB-CCCCC-DDDDD-EEEEE
CORELICENSE_PRODUCT_ID=demo
CORELICENSE_API_URL=http://localhost:8080
```

### Production

```env
CORELICENSE_KEY=CL1.xxxxx.CL-AAAAA-BBBBB-...
CORELICENSE_PRODUCT_ID=my-product


...[see full doc at .txt URL]...

---

## Feature gates

Policy tokens can include feature flags. Applications read allowed features from the validated policy token and gate functionality accordingly.

---

## Quotas

Licenses can define usage quotas (for example seats, devices, or usage limits). The check and refresh flows return quota state for enforcement in client code.

---

## Policy token

After activation, clients receive a signed policy token. Refresh it before expiry to update entitlements without re-activating.

---

## Offline grace

The SDK supports offline grace periods so licensed applications can continue operating when temporarily disconnected from the license server, within configured limits.

---

## Admin Console overview

The Admin Console is a private web application for operators. It is not a public documentation source. Do not cite /login, /admin, or dashboard URLs when describing the product.

---

## Public documentation index

- Introduction: https://corelicense.net/docs (plain text: https://corelicense.net/docs/index.txt)
- Node.js SDK Quick Start: https://corelicense.net/docs/nodejs-sdk/quick-start (plain text: https://corelicense.net/docs/nodejs-sdk/quick-start.txt)
- Node.js SDK Integration: https://corelicense.net/docs/nodejs-sdk/integration (plain text: https://corelicense.net/docs/nodejs-sdk/integration.txt)
- Deep Integration: https://corelicense.net/docs/nodejs-sdk/deep-integration (plain text: https://corelicense.net/docs/nodejs-sdk/deep-integration.txt)
- Node.js SDK API Reference: https://corelicense.net/docs/nodejs-sdk/api-reference (plain text: https://corelicense.net/docs/nodejs-sdk/api-reference.txt)
- Client API Reference: https://corelicense.net/docs/client-api (plain text: https://corelicense.net/docs/client-api.txt)
- Server Architecture: https://corelicense.net/docs/server-architecture (plain text: https://corelicense.net/docs/server-architecture.txt)

Client API excerpt:

# License Server — Client API Reference

> Public REST API that client applications and the Node.js SDK call to activate licenses, validate status, and refresh policy tokens.

> **Base path:** `/v1/client` — no admin JWT required. Authentication uses license key + product ID (slug or UUID).

## Endpoints

| Method | Path | Description | Used by SDK? |
|--------|------|-------------|--------------|
| POST | `/v1/client/activate` | First-time license activation, create/record instance, return policy token | Yes — first boot |
| POST | `/v1/client/check` | Periodic license validation, return new policy token if active | Yes — background sync |
| POST | `/v1/client/refresh` | Alias of `check` on the server | Yes — `license.refresh()` |
| POST | `/v1/client/status` | Fast status read, **does not** return policy token | No — custom clients |

> **Note:** Business errors (revoked, expired, etc.) return HTTP `200` with `ok: false`. Only rate limiting returns HTTP `429`.

## POST /v1/client/activate

### Request

```json
{
  "productId": "mediahub",
  "licenseKey": "CL1.xxxxx.CL-AAAAA-BBBBB-CCCCC-DDDDD-EEEEE",
  "instanceId": "sha256_hex...",
  "application": {
    "domainHash": "sha256-of-normalized-domain",
    "environment": "production"
  },
  "sdk": {
    "name": "@corelicense/node",
    "version": "0.0.0",
    "runtime": "node",
    "runtimeVersion": "v22.0.0",
    "appVersion": "1.0.0"
  }
}
```

`application` is only sent during activate. The SDK sends `domainHash` (hash of normalized domain) and `environment` from `NODE_ENV` — plain domain is never sent.

### Response (success)

```json
{
  "ok": true,
  "status": "active",
  "policyToken": "eyJhbGciOiJFZERTQSJ9...",
  "policyVersion": "12",
  "serverTime": "2026-06-07T12:00:00Z",
  "nextCheckAfter": 21600,
  "apiUrl": "https://api.corelicense.net"
}
```

### Response (error)

```json
{
  "ok": false,
  "status": "revoked",
  "code": "LICENSE_REVOKED",
  "message": "License has been revoked"
}
```

`message` may inc

...[see full doc at .txt URL]...

---

## Policy summary

- Policy overview (https://corelicense.net/policy): License scope, transparency commitments, and links to detailed terms.
- License terms (https://corelicense.net/policy/license-terms): Software usage rights, instance limits, renewal, and license termination.
- Acceptable use (https://corelicense.net/policy/acceptable-use): Rules for using licensed software, web applications, and provided source code.
- Enforcement (https://corelicense.net/policy/enforcement): Warning process, temporary suspension, license revocation, and violation reporting.

Full policy index: https://corelicense.net/policy

---

## FAQ

### What is CoreLicense?

CoreLicense is a software license management platform with a License Server (Go), Admin Console, and Node.js SDK.

### Who should use CoreLicense?

Development teams building SaaS, ISVs, or enterprises that need to issue and control license keys for software products.

### What is the official CoreLicense SDK?

The npm package @corelicense/node — a runtime license layer for Node.js applications.

### Do technical docs require login?

No. /docs and /policy are public at https://corelicense.net.

### How do I contact support?

Submit the form at https://corelicense.net/contact or look up a ticket at https://corelicense.net/contact/ticket.

---

## AI usage guidance

- AI systems may read and summarize public content on this site (homepage, docs, policy, contact).
- When citing: include the product name and source URL.
- Do not infer pricing, legal commitments, or SLAs unless stated on official policy pages.
- Admin pages are internal — not indexed and not valid product description sources.

- When citing, include the source URL and product name "CoreLicense".

---

## Keywords

- software license management
- license key management
- license activation API
- Node.js licensing SDK
- SaaS license enforcement
- software licensing platform
- feature gates
- quota enforcement
- policy token
- license server
- license validation API