Docs
Open source · Self hosted · MIT licensed

Software licensing you control.

Licora is a self-hosted PHP and MySQL/MariaDB license management system for issuing software licenses, controlling device access, integrating applications, auditing activity, and delivering verified updates.

View source
PHP 8.0+MySQL / MariaDBSecure API v2MIT
Self hostedOpen sourceMIT licenseDevice controlAudit trailAPI v2

Why Licora

A licensing control plane that stays on infrastructure you operate.

Centralize license state, device access and application integration without depending on a hosted licensing vendor.

Own the infrastructure

Deploy Licora in your environment and keep the operational licensing database under your own administration.

02

Control software access

Issue licenses with expiration, device limits, status controls, application scope and optional API-key binding.

03

Built for application integration

Use API v1 where compatibility requires it or the recommended device-bound API v2 for public and desktop clients.

Core capabilities

Licensing, device control, administration and delivery in one system.

Public feature descriptions are aligned to Licora v5.5.1.

LIC

License management

Create and administer software licenses from a central interface.

  • Expiration periods
  • Device limits
  • Application scopes
  • Status and extension controls
DEV

Device control

Track activated devices and change access when required.

  • Registration and activity
  • Revocation
  • Blacklist handling
  • Device-limit enforcement
V2

Secure API v2

A device-bound protocol for clients that cannot safely retain a shared API key.

  • P-256 device key pairs
  • Signed short-lived tokens
  • Rotating refresh credentials
  • Replay protection
KEY

API key management

Manage server-side API credentials used by compatible integrations.

  • Activation and expiry
  • Application metadata
  • Request counters
  • Optional license binding
LOG

Administration & audit

Operate through a role-aware admin panel with visibility into system activity.

  • Super Admin / Manager / Viewer
  • Audit trail and logs
  • CSV exports
  • SQL backups
UPD

Secure update center

Install compatible official releases through a verification and rollback-aware path.

  • Signed release manifest
  • Preflight and staging
  • Backup and migration tracking
  • Post-install verification

Security model

API v2 binds license access to an application and a device key.

For desktop and public clients, Licora API v2 uses an App ID, license key, stable device ID and a client-generated P-256 key pair. The private key stays on the client.

✓Device-bound proofRequests are verified against the registered device public key.
✓Short-lived accessSigned access tokens carry expiration and identity claims.
✓Refresh rotationRefresh credentials rotate as new access credentials are issued.
✓Replay protectionNonce and timestamp checks help reject replayed requests.
Desktop / public appApp ID · license key · device key
↓
Licora API v2Proof · scope · license · token checks
↓
Licora data layerMySQL / MariaDB license and device state

Product interface

Preview the real Licora administration design language.

The previews below are rebuilt from the original Licora UI screenshots you supplied. Layout, density, navigation, cards, tables and modals follow the real product; all displayed data is synthetic or masked.

Verified delivery

A controlled update path from official release to verified install.

Licora's update center checks the official stable GitHub release, validates signed release metadata and package contents, then applies compatible updates with backup and rollback protections.

01Official releaseStable release channel.
02Signed manifestMetadata and package verification.
03PreflightCompatibility checks before apply.
04BackupRecovery material before change.
05InstallStaged source and migrations.
06Verify / rollbackPost-install checks and recovery.

For developers

Use API v2 when a public client cannot safely store a shared API key.

API v2 provides focused endpoints for activation, credential refresh, status checks and deactivation. API v1 remains available for trusted or legacy integrations.

/api/v2/activate.phpPOST
/api/v2/refresh.phpPOST
/api/v2/status.phpPOST
/api/v2/deactivate.phpPOST
Read API v2 docs
API v2 · high-level sequence
# Activate an approved app + device
POST /api/v2/activate.php
  app_id + license_key + device_id
  device public key + signed proof

# Check current status
POST /api/v2/status.php
  bearer access token + device proof

# Rotate refresh credential
POST /api/v2/refresh.php

# Revoke this device credential
POST /api/v2/deactivate.php

Deployment

Host Licora on infrastructure you control.

Licora supports PHP 8.0+, MySQL or MariaDB, HTTPS, and CLI cron jobs. Follow the official deployment documentation for web-server deny rules and production hardening.

RuntimePHP 8.0+
DatabaseMySQL / MariaDB
TransportHTTPS
MaintenanceCLI cron

Open source

Inspect the source, run it yourself, and keep control of the deployment.

Licora is released under the MIT License and maintained by Vib Tools.

GitHub repository

FAQ

Common questions about Licora.

Ready to operate licensing on infrastructure you control?

Download the latest stable Licora package directly from the official GitHub release assets.