Security
Security-first, by design
Licensing infrastructure holds the keys to your revenue. Licenta treats tenant isolation and credential handling as hard security boundaries.
Ed25519 signing (libsodium)
Offline entitlements are signed with Ed25519 and verified locally against the product’s embedded public key. Tampering is cryptographically detectable.
Credentials are hashed, not encrypted
License keys and API keys are stored as HMAC-SHA256 hashes with an application pepper. They are never recoverable in plaintext — a database leak does not expose working keys.
Encrypted at rest
Signing private keys and webhook secrets are encrypted at rest with Laravel’s application encryption. The signing private key never leaves the server.
Fail-closed tenant isolation
Every tenant-scoped query is bounded by organization. A missing tenant context fails closed rather than leaking across tenants — enforced by a cross-tenant test matrix.
Concurrency-safe activation
Activation, deactivation, and revocation serialize through a row-level lock (SELECT … FOR UPDATE + READ COMMITTED), so a license can never exceed its activation limit under simultaneous requests.
Non-enumerable identifiers
Public identifiers are ULIDs — no auto-increment integers to enumerate, no data leakage through predictable IDs.
Scoped API keys
API keys carry explicit scopes and optional product restrictions. Embed a narrow-scope key (activate/validate/deactivate) in shipped software; never ship a management key.
SSRF-safe webhooks
Webhook delivery re-validates the URL against an internal-IP deny list on every attempt and never follows redirects — preventing server-side request forgery to internal services.
Access control & auditing
Two-factor authentication (TOTP) at login, role-based access control, and append-only audit logs. GDPR export and erasure endpoints are built in.
Verification
Backed by tests
Licenta ships with a security test suite covering cross-tenant isolation, forged entitlements, replay and idempotency, brute-force rate limiting, and — critically — a real MySQL concurrent-activation race test that spawns parallel processes and asserts a license can never be over-provisioned.
Start issuing licenses today.
Self-host on your infrastructure, or run the Docker Compose stack in minutes. Your keys, your data, your rules.