License key management

Question

I have a desktop application that can run in trial mode. The user decides to enter a license key. I check it and, if valid, the application will no longer run in trial mode.

What should I do with the license key after this? Where should I store it? Do I have to check if the license key is valid every time the application starts? I want to know what should I do when a user enters a license key? Thanks

Answer 1

I suggest that with a successful online check, the server returns something that can be checked offline - perhaps signed with a private key, for which the application has a public key (Google public key cryptography) - so it can be checked locally, without a local copy that has enough information to create a valid local validation token.

The local check must have a start and end time, and if for some reason the token is invalid, an online check must be performed. If the token has expired recently (at the given value of the latter), and the online check failed, the system allows access to give some time delay.