FAQ
Frequently asked questions
Answers on isolation, offline licensing, billing, API keys, deployment, and more.
Is my tenant’s data isolated from other tenants?+
Yes. Tenant isolation is enforced at the query layer and fails closed. A dedicated cross-tenant test matrix asserts foreign resources return 404, never data.
Can I verify licenses offline?+
Yes. Ed25519-signed entitlement files are verified locally with the embedded public key. Offline revocation takes effect the next time the installation comes online.
What happens when a customer’s payment fails?+
A Stripe webhook automatically suspends that customer’s active licenses. You can also suspend or revoke manually at any time.
Can I embed an API key in my shipped app?+
Yes — use a narrow-scope lk_live_... key limited to licenses.activate, licenses.validate, and licenses.deactivate. Never ship a management-scope key.
Does the API contract change?+
No. /api/v1 is stable. Additive changes are allowed; breaking changes require a new major version with a deprecation window.
Can I run this on shared hosting?+
Yes — the MVP uses the database queue/cache driver and a single cron entry. No Redis, Docker, or Node required.
Where are signing keys stored?+
Generated and used server-side only. The private key is encrypted at rest and never leaves the server.
Start issuing licenses today.
Self-host on your infrastructure, or run the Docker Compose stack in minutes. Your keys, your data, your rules.