Keyrail
Sign in Join waitlist

Licensing for Tauri, Electron and Rust apps

License keys for desktop apps, without running a license server.

Keyrail listens to your Paddle Billing or Lemon Squeezy webhooks, issues the license key, enforces machine limits, and hands your app an Ed25519-signed certificate it checks offline. You ship the feature. We keep the keys, renewals and refunds in sync.

Join the waitlist Read the Tauri quickstart
  • Works offline for 30 days by default
  • No telemetry
  • Data stored in the EU
  • MIT-licensed SDKs
src-tauri/src/lib.rs
pub fn run() {
    let keyrail = tauri_plugin_keyrail::Config::new(
        "prd_7k2m9q4x1c8d3f6h0j5n",
        [("k1", "pZ3vC0x6hYjQ8m1K4tR9wN2bF7sL5dA0eUqTgHiOcVk")],
    );

    tauri::Builder::default()
        .plugin(tauri_plugin_keyrail::init(keyrail))
        .run(tauri::generate_context!())
        .expect("error while running the app");
}
src/license.ts
import { activate, check, hasEntitlement } from '@keyrail/tauri-plugin';

// Offline: verifies the cached certificate, refreshed online once a day.
let state = await check();

if (!state.valid) {
  // One online call. The app then runs offline, refreshing silently.
  await activate(licenseKey); // "KR-7K2M9-Q4X1C-8D3F6-H0J5N"
  state = await check();
}

if (hasEntitlement(state, 'export')) enableExport();

How it works

Three steps, about ten minutes.

  1. Connect Paddle or Lemon Squeezy

    Create a product, paste the webhook URL Keyrail gives you into your payment provider, and map each price or variant to a plan. A completed purchase creates the license and emails the key to your customer.

    Paddle Billing Lemon Squeezy

  2. Embed the SDK

    Add the Tauri plugin, the Rust crate or the Node client. Configure two values: your product ID and its public signing key. No secret ever ships inside your app.

    Tauri Electron Rust

  3. Customers activate

    Your customer pastes the key once. The machine gets a signed certificate and the app starts instantly from then on, online or not. Renewals, failed payments, cancellations and refunds update the license through webhooks.

    Licenses and statuses

Offline-first

An outage on our side never locks your customers out.

Most license checks call home at every launch. Keyrail doesn’t need to. Your app receives a small certificate, signed with your product’s private key, which never leaves Keyrail. The SDK verifies it locally with the public key compiled into your app: product, machine fingerprint, status, expiry and version are all checked without a network call.

  • Silent refresh once a day when the network is there, so renewals and cancellations propagate.
  • Valid offline for 30 days by default; you choose the window per product.
  • Clock rollback detection and per-product machine fingerprints.
  • A documented format with public test vectors: verify it in any language.
How an offline certificate works The app sends the license key and a hashed machine fingerprint to Keyrail once. Keyrail answers with an Ed25519-signed certificate. The app verifies it locally with the product's public key. From day 1 the SDK refreshes it silently whenever the network is available; without network the certificate stays valid until its expiry, 30 days by default. Your app SDK + your public key Keyrail API holds the private key activate: key + fingerprint hash KR1 certificate, Ed25519-signed Valid offline: verified locally at every launch, no network needed Day 0 activate Day 1 refreshAfter Day 30 expiresAt (offlineDays) From day 1, when online: silent revalidation, new certificate, the 30-day window starts again. Renewals and cancellations arrive here.
One online call to activate. After that, every launch is a local signature check. Default offline window: 30 days, configurable per product.

What you get

The licensing parts you would otherwise build twice.

Subscriptions that stay in sync

Payments, failed renewals, cancellations, pauses and refunds from your provider’s webhooks map to clear license statuses, with a grace period you set.

Machine activation limits

One key, a set number of machines per seat. Customers free a machine themselves from the portal, or your app calls deactivate.

Perpetual licenses, done right

Sell one-time licenses that cover a major version. Version 2 ships, version 1 buyers keep working and see an upgrade path.

Trials and entitlements

Trial plans with a fixed length, and feature flags such as export or ocr carried inside the signed certificate.

Customer portal

A hosted page where your customers sign in by email link, find their keys and manage their machines. Fewer support emails for you.

Vendor API and audit log

Every license, activation and webhook is visible in the dashboard and through a REST API with secret keys. Signing keys can be rotated; older keys stay valid for verification.

Built for

Your stack, not a generic web SDK.

Tauritauri-plugin-keyrail + @keyrail/tauri-pluginRust does the verification, your frontend gets typed commands. Electron@keyrail/clientRuns in the main process, zero runtime dependency, exposed to the renderer over IPC. Rust and nativekeyrail crateVerification and an online client behind a feature flag. Fits egui, Iced, Slint or a CLI.
.NETcoming nextWPF, WinUI and Avalonia. Join the waitlist to hear when it lands.
Anything elseHTTP API + certificate specThree JSON endpoints and a verification algorithm with test vectors.

Privacy and hosting

Your customers’ data stays small, and is stored in the EU.

Keyrail stores what licensing needs and nothing else, in a database located in the European Union (Cloudflare D1, EU jurisdiction). Requests are handled at Cloudflare’s edge, close to your users. The SDKs do not collect usage data: they talk to Keyrail only to activate, refresh and deactivate.

What we store, and what we don’t

Stored

Customer email and name, hashed machine fingerprints, machine names if your app sends them, salted IP hashes for rate limiting (30 days).

Never stored

Card data (your payment provider handles it), raw hardware IDs, usage analytics, crash reports, file names.

Encrypted at rest

Private signing keys and license keys, with AES-256-GCM. Secret API keys and session tokens are kept as hashes only.

GDPR

A data processing agreement and a public list of subprocessors, for your own privacy policy.

Pricing

Priced by active licenses, not by API calls.

Limits are soft: going over never blocks your customers’ apps. We email you and you upgrade from the dashboard when it suits you. Paddle, our merchant of record, handles payment, VAT and invoices.

Free

$0

Free forever, no card

  • 100 active licenses
  • 1 product
  • Unlimited activations and validations
  • Paddle and Lemon Squeezy webhooks
  • Offline signed certificates
  • Community support
Join the waitlist

Indie

Most picked

$29$24.17/ month

or $290 per year, 2 months freebilled $290 per year

  • 1,000 active licenses
  • 3 products
  • Unlimited activations and validations
  • Paddle and Lemon Squeezy webhooks
  • Offline signed certificates
  • Email support
Join the waitlist

Pro

$79$65.83/ month

or $790 per year, 2 months freebilled $790 per year

  • 10,000 active licenses
  • Unlimited products
  • Unlimited activations and validations
  • Paddle and Lemon Squeezy webhooks
  • Offline signed certificates
  • Email support
Join the waitlist

Business

From$199$165.83/ month

or $1,990 per year, 2 months freebilled $1,990 per year

  • Custom active licenses
  • Unlimited products
  • Unlimited activations and validations
  • Paddle and Lemon Squeezy webhooks
  • Offline signed certificates
  • Email support
  • Custom limits and DPA review
Talk to us

Compare plans in detail

FAQ

Questions developers ask first

What happens to my users if Keyrail is down?

Nothing visible. Apps verify their certificate locally, and a certificate stays valid offline for 30 days by default. The SDK retries the refresh later. Only a first activation needs the API.

Can’t someone just patch the check out of my binary?

Any check that runs on a customer’s machine can be patched by a determined person, and we won’t pretend otherwise. What Keyrail guarantees: nobody can forge a valid certificate without your private key, a shared key stops working beyond its activation limit, and refunded or charged-back licenses stop refreshing. That keeps honest customers honest without punishing them.

Do I need Paddle or Lemon Squeezy?

No. You can create licenses from the dashboard or the vendor API, for example for resellers, bundles or your own checkout. Paddle Billing and Lemon Squeezy are supported out of the box; Stripe is planned.

Doesn’t my payment provider handle license keys?

Paddle Billing has no built-in license keys or machine activations. Keyrail fills that gap from its webhooks, and does the same for Lemon Squeezy with offline certificates and an API that is identical for both.

Does the SDK phone home or collect analytics?

No telemetry. The SDK sends a request only to activate, to refresh a certificate (at most about once a day when online) and to deactivate. Each request carries the license key, a hashed fingerprint and optionally the machine name, platform and app version.

What counts as an active license?

A license your customers can use right now: paid, in its grace period or perpetual. Expired, refunded and revoked licenses don’t count. Machine activations are unlimited on every plan.

What if Keyrail shuts down? Can I leave?

A new service run by a small team is a fair worry, so here is what does not depend on us: certificates already issued keep verifying offline until they expire; you can download every license key and the private signing keys of your products at any time, so you can sign certificates yourself and your apps, unchanged, accept them; the certificate format is documented with test vectors; the SDKs are MIT-licensed and take any API base URL. And we commit to at least 90 days’ notice before discontinuing the service. Details and limits on the security page.

Early access

Get a key when Keyrail opens.

We are onboarding a small group of desktop vendors first. Leave your email and we will write once, when your spot is ready.