Selling
License Keys: Sell Software and Digital Products
Keep a pool of license keys against a digital product, deliver one automatically when an order is paid, limit how many devices each key may activate, let buyers manage their own activations from a portal, and revoke a key that is being abused.
Overview
License keys let you sell something that needs unlocking — software, a plugin, a font, a course, a device — and have the key handed to the buyer the moment their payment clears.
- A pool per product. Each digital product has its own pool of keys. You paste in keys you already own, or have them generated for you.
- Delivery is automatic. When an order containing that product is paid, a key is taken from the pool, marked assigned to that order, and emailed to the buyer.
- Activation limits, enforced. A key carries a maximum number of activations. Your software calls BestWebby to activate, and the call is refused once the limit is reached.
- Buyers manage their own devices. A buyer can see where their key is active and release a device themselves — the single most common support request for licensed products, answered without you.
- Revoke at any time. A chargeback, a refund, or a key posted on a forum: revoke it and every future activation check fails.
- Sharing shows up. Activations record the device and the address they came from, and suspicious patterns are flagged for you to look at.
Who can use it. There is no plan restriction — access is controlled by permissions. Adding keys in bulk needs the products:bulk permission; revoking a key needs products:write. Both sit with the people who already manage your catalogue.
Step 1: Put keys in the pool
Go to Catalog → License keys and choose the digital product you are selling. The pool for that product opens with a health bar across the top: available, assigned, revoked and expired.
Click Add license keys and either:
| Option | When to use it |
|---|---|
| Paste your own keys | You already have keys from the software vendor, or you generate them yourself. One per line. |
| Generate them | You just need unique, unguessable strings and do not care about their shape. |
For each batch you set:
| Setting | What it does |
|---|---|
| Max activations | How many devices one key may activate. Set 1 for a single-seat licence, 3 for a small team, and so on. |
| Expires | Optional. After this date the key stops activating, which is how you sell a year of something. |
| Notes | Free text for you — where the batch came from, which reseller, which campaign. |
Step 2: Watch the pool, not the orders
The health bar is the thing to keep an eye on. When available runs low, add another batch — if the pool empties, an order for that product still completes and the buyer is left waiting for a key, so it is worth setting a reminder while the number is still comfortable.
The list below filters by status, and a flagged only filter shows the keys whose activation pattern looks like sharing rather than use.
Step 3: What the buyer gets
The buyer receives their key by email as soon as the order is paid, and can open the licence portal to:
- see the key itself;
- see each device it is active on, with the date it was activated;
- release a device they no longer use, which frees an activation.
That last one matters: without it, every new laptop becomes a support ticket.
Step 4: Wire your software to the activation API
Your product calls BestWebby to check the key. Three endpoints:
| Endpoint | What it does |
|---|---|
| Activate | Claims one activation for a device id you supply. Refused when the key is revoked, expired, or already at its limit. |
| Verify | Confirms a key is still valid for a device. Call it on start-up, or periodically. |
| Deactivate | Releases that device's activation, so the seat can move to another machine. |
Send a stable device id — a machine fingerprint or installation id — not the user's email, and keep it the same across restarts, or every launch will consume an activation. You may also send a human-readable device label, which is what the buyer sees in their portal.
Step 5: Revoking
Open the key and choose Revoke. Revocation is immediate and not reversible: existing activations stop verifying and no new ones are accepted. Use it for a refund, a chargeback, or a key that has leaked. The key stays in the list with a revoked status, so you keep the record of what happened.
Reseller batches
A batch of keys can be tagged to a reseller, so when a key turns up in the wild you can tell which batch it came from. If you sell through resellers, generate a batch per reseller rather than mixing them.
What this is not
- It does not write the licence check inside your software; it gives you the API your software calls.
- It does not meter usage or seats beyond counting activations.
- A key is tied to the product it was pooled against, not to a bundle or a subscription term. For recurring access, sell a subscription and issue a key with an expiry that matches it.