Web-based license activation

Question

I have an existing app that has a free trail, and the same code/download can also be "upgraded" to a full-featured application by giving it a "license key". This is done with some magic and the semi-hacky method of getting some name for a machine. So, basically I am selling licenses per computer.

The current payment and activation proceed as follows:

Customers pay via paypal, then I get an email from paypal and then send customer an email to request their ID, so I can send back a license key. This is not optimal for a lot of reasons.

If I were a customer I would not be impressed.

The topic is briefly addressed and mentioned here:

http://secretgeek.net/25steps_21tools.asp

Unfortunately I am not sure of the good alternatives. I want to be able to do all this programmatically. I do have my own domain and it is hosted on linux server. I can server side code if needed I suppose.

What I want is an automated process for getting the license key to the client. They will have to either supply the machine ID up front (no way that I can see in paypal) or in a response to an email.

In many/some cases the software is not on a machine with internet access, so a pay through the software is no good.

I can think of lots of rube-goldberg things that involve code on my website, some involving databases, all involving CCing me with license keys, etc.

Paying for the service is fine - I do not want to spend my time on this stuff - I have lots to do to upgrade the product.

It is Win32 right now - moving to Mono soon hopefully.

I prefer to keep the licensing scheme as it is - with a key tied to a machine.

Does anyone have a nice clean solution?

EDIT: Both answers (only two as of this writing) are good. I am going to do the paypal IPN thing and have the IPN notified page send an email with a link to a form. It also will make an entry into a database with the authcode - which will be checked later.

The customer goes to the link, enters the details from their specific machine and the auth code I send from the IPN/Paypal. I check the database to ensure this is valid and not a duplicate, and then if successful display the license key and also email it to them.

Not implemented yet, but it should all work. Just have to hack out some php.

EDIT

Thanks for the suggestions. This is all done and working now using PHP, mySQL and paypal ipn.

Answer 1

what i do is offer two paths:

i provide a Register program as part of the installation package, which reads the machine identity info and writes it (encrypted) to a local file. It then attempts to contact a web service to generate the license key.

If the program cannot reach the web service, it tells the user the name and location of the machine-info file and the email address to mail it to. I can then generate a key from that and email the key back

Answer 2

Here is the scheme I use for a commercial product which works well for me.

Upon purchase use PayPal IPN to generate an activation number server side (I do this with PHP + MySQL), store it in a database and e-mail it to the new customer.

Customer receives the activation code and enters it into your product.

The product verify's the activation code and then generates a hardware/machine code. It then goes back to your server (I use an authenticated HTTP POST request back to my server) to verify if the activation number is still active and if the machine code is ok.

Server side you can check if the machine code has not been activated before you associate the machine code with the activation number and tell the product to allow activation.

If the activation code has all ready been used you can disallow activation.

You can build on all this for more features. Like most copy/license protection it can be bypassed but it gives you a decent amount of control over your legit customers.

Answer 3

Dear QAZ,

What all information are you providing to paypal for transaction and based on what output from paypal you decide wheather the transaction was successfull or not.

Once the trasaction is successfull i guess you are getting redirected to you website and there you generate the activation code for the customer and send the code via email to the customer rite?

Thanks.