Every seller eventually asks how to stop their item being copied. The honest answer is more useful than the reassuring one.
What cannot be done
No licence check that runs on somebody else's server can be made uncrackable. Your code is on their machine, and code on a machine somebody controls can be read and changed. Anyone selling you a scheme that cannot be broken is selling you something.
Obfuscation raises the effort a little and costs you real things: harder debugging, hosts that refuse to run it, and buyers who will not touch code they cannot read.
What licence checking actually achieves
All of these are real, and together they are worth the afternoon it takes to integrate:
- It keeps honest buyers honest, which is the large majority of them.
- It makes casual copying more effort than paying.
- It stops one licence quietly becoming fifty across an agency, which is where sellers lose the most.
- It gives you a record of where your item is actually installed.
The mistake that hurts your own buyers
Fail closed and you have built a way for your item to break every customer site at once. Our API has a bad ten minutes, and every install goes dark. Your buyers do not know it was us. They know your item broke their site, and that is what the review says.
Treat an unreachable API as "carry on", never as "shut down".
Distinguish the two cases. A definite negative, where we reply that the licence is invalid, is a real answer, and you should act on it. No reply at all is not an answer, and should change nothing.
Practical integration rules
- Check on install and occasionally after, never on every page load.
- Store the signed token and work from it between checks.
- Short timeout, a few seconds, so a slow response never hangs a page.
- Log failures quietly for yourself rather than showing them to the buyer.
The PHP SDK does all of this already, which is the main argument for using it rather than writing your own.
What genuinely cannot be copied
Whatever your item does that depends on your server. A service you host, data you maintain, updates only you can publish. If part of the value lives at your end, a copied zip is worth much less than the real thing.
Start with the API documentation, and the article on failing open.
