Keyrail
Sign in Join waitlist

Changelog

What’s new in Keyrail

Release notes for the service, the dashboard and the SDKs, newest first. Breaking changes to the client API or the certificate format are always announced here first, with a migration path.

Private beta preparation — 2026-10-13#

Everything below works end to end in our test environment and is what private beta participants will use first.

Licensing service

  • License keys, machine activation limits per seat, and the three client endpoints: activate, validate and deactivate.
  • Offline certificates signed with Ed25519, one signing key per product, with public test vectors for your own verifier.
  • Subscriptions, perpetual licenses limited to a major version, trials and entitlements carried inside the certificate.
  • Paddle Billing and Lemon Squeezy webhooks: purchases, renewals, failed payments, cancellations, pauses and refunds update the license, and the key is emailed to your customer.
  • Vendor API with secret keys, and an audit log of webhooks, status changes and activations.
  • Customer portal: your customers see their licenses and free a machine themselves.
  • Two-step signing key rotation: add a new key, ship it in a release of your app, then make it the signing key, so no installed version is cut off.

Dashboard

  • Products, plans, licenses and their activations, customers, integrations, API keys, the event log, and SDK snippets prefilled with your product’s public keys.
  • Self-serve Keyrail plans: upgrade, switch plan or billing period, and manage billing from Account & usage. Paddle is the merchant of record for Keyrail subscriptions. Limits stay soft: a plan change never affects your customers’ licenses.

SDKs

  • keyrail Rust crate and tauri-plugin-keyrail for Tauri 2, and @keyrail/client for Node and Electron, with the same behaviour: offline verification, hashed machine fingerprint, cached certificate and silent refresh.
  • Consistent errors across SDKs: a certificate that is not authentic for your app is rejected with invalid_certificate, and every SDK uses a 10 second request timeout by default.