Self-hosted license distribution
Velsigil is a license distribution and management panel for software sellers. Issue and validate license keys for your apps, bind them to devices, ship updates and give customers a self-service portal. You run it, and your data stays on your server.
Free during early access. For businesses established in the United States.
const client = new VelsigilClient(
API_URL, PRODUCT_ID, PUBLIC_KEY,
{ store: new FileStore(dir) });
const result = await client
.validateWithOfflineFallback(
licenseKey, { version: '1.2.0' });
if (!result.ok)
exitWithLicenseError(result.code);
if (result.hasFeature('pro')) enablePro();Why Velsigil
Selling desktop or server software means handing out keys, shipping updates and answering “I got a new PC” emails. Velsigil gives you the parts of a licensing service you would otherwise build or rent, on a server you control.
Features
One panel for keys, devices, releases, customers, staff and security.
Products, plans and keys with the lifecycle a software business needs.
Your software asks your server, then checks that the answer is genuine.
Ship builds to licensed customers only.
Customers help themselves. No customer accounts to manage.
Give every person exactly the access they need.
See what happens, and act on it.
How self-hosting works
Run Velsigil on Linux with Docker Compose or on Windows Server behind IIS. Secrets are generated on your server; we never see them. Early-access members get help with installation by email.
Each product gets its own Ed25519 signing key. Plans set the duration, device limit and features of a license.
Build your server address, the product ID and its public key into your software, and validate the key when it starts.
Create keys from your shop through the REST API, react to license events with webhooks, and let customers manage devices in the portal.
Deployment
Both setups run the same stack in Docker containers: the Velsigil app on Node.js and PostgreSQL 18, with daily encrypted backups and weekly restore tests.
A small installation, up to about 10,000 licenses, needs 2 vCPUs, 4 GB of RAM and 40 GB of disk. The installation package for customers is being finalized during early access; early-access members get help with installation by email.
SDKs
Each SDK checks the signature before it reads a response, keeps the device secret and offline lease, and verifies downloads against their signed hash.
Velsigil.Client
.NET Standard 2.0 and .NET 8. Async API.
velsigil::Client
C++17, built with CMake; dependencies through vcpkg.
velsigil-client
Python 3.8 or later. Standard-library HTTP.
velsigil-client
Node.js 18 or later. ESM and CommonJS, no dependencies.
The SDKs are included with Velsigil as source code. They are not published on package registries yet. The client protocol is documented, so you can also write your own.
Security
Velsigil’s security requirements are based on OWASP ASVS 4.0.3 Level 2. That is a design target, not a certification, and Velsigil has not had an external penetration test yet.
License answers from your server carry an Ed25519 signature. The SDKs check it before they read anything.
Nonces and timestamps make a recorded answer useless on another request.
License keys are shown once. The database keeps only a keyed hash and the last five characters.
Owners and admins must use TOTP. Sensitive actions ask for the password and code again.
Detectors for brute force, credential stuffing and suspicious activations, IP blocks and emergency switches including lockdown.
Staff actions are recorded. In the standard Docker setup, the application’s database role cannot change past entries; old ones are removed only by the retention schedule you set.
Staff passwords are hashed with Argon2id. Common passwords are rejected.
Backups are encrypted, and scheduled restore tests show that they can actually be restored.
Pricing
Planned launch pricing. It may change before launch. Monthly or annual; the annual plan gives you two months free. Prices do not include sales tax.
No. You install Velsigil on your own server and run it yourself. We do not host installations.
No. Connect your shop or payment provider through the REST API with a scoped API key, and react to license events with signed webhooks.
The SDKs fall back to the signed offline lease from the last successful check, for as long as you allow per product, and only when the server cannot be reached. Emergency switches such as lockdown never stop devices that are already activated from validating.
No licensing system can stop a determined person from patching a check out of a binary. Velsigil makes sure that answers from your server cannot be replayed, or forged while your signing keys stay secret, and that key sharing is visible and limited. Keep valuable features or content on the server side as well.
SDKs for C# / .NET, C++, Python and Node.js are included as source code; they are not on public package registries yet. Other languages can use the documented client protocol.
No. Velsigil never contacts us. It connects out only for things such as email, your webhooks, TLS certificates and the breached-password check. That check is on by default, sends only the first five characters of a password’s hash, and can be turned off in Settings.
For now, only businesses established in the United States.
Updates and security fixes stop, and new releases are no longer available to you. Velsigil never locks out your customers. You can renew at any time. The license agreement, published before paid launch, will set out the terms for use after a subscription ends.
You use Velsigil free of charge during early access and give us feedback in return. Spots are limited and we reply to every request by email. Early-access members get 30% off their first year when paid subscriptions launch.
Early access ends when paid subscriptions launch; we will tell members by email before then. To keep using Velsigil after that, you need a subscription. The 30% discount applies to the first 12 months of either plan, paid monthly or yearly.
Early access
Early access is free. In exchange, we ask for your feedback while we prepare the paid launch. Spots are limited, and we reply to every request by email.
Early access ends when paid subscriptions launch; we will tell members by email before then. To keep using Velsigil after that, you need a subscription. The 30% discount applies to the first 12 months of either plan, paid monthly or yearly.
Opens your email app with a short template: company, what you sell, your platforms and languages, expected license volume and how you plan to deploy. You can also write to hello@velsigil.com.