How to tie a licence to a machine, verify it continuously, and cut access the moment it stops being valid.
A business plugin sold to a few dozen engineering firms raises a problem web applications never face: it runs on the customer's machine, out of the server's reach. Nothing technically prevents copying it onto ten workstations.
The approach taken ties the licence to the machine rather than the user. On first launch, the plugin builds a fingerprint from hardware and system elements — MAC address, Windows information, installation coordinates — and sends it to a REST verification API. The server maps that fingerprint to a licence and returns a verdict.
A single check at startup is not enough: it lets a revoked licence keep working until the next restart, which can mean weeks. A heartbeat mechanism therefore calls the platform at regular intervals. If the licence has been revoked, has expired, or the fingerprint no longer matches, access is cut within the running session.
On the admin side, an ASP.NET Razor Pages interface creates, revokes and tracks licences. It is deliberately plain: the tool serves an internal team, not an online catalogue, and an over-designed interface would have cost time without returning any.
An honest caveat to close on: no client-side protection is unbreakable. A .NET plugin can be decompiled, and a hardware fingerprint can be forged by someone determined. The realistic goal is not to make copying impossible — it is to make it more expensive than buying, and to give the vendor a way to revoke a licence.
I write more of these at my technical notes — multi-tenant isolation, optimistic concurrency, AutoCAD plugin development, and other things I've actually shipped.
