Desktop, CLI & Plugins licensing · MCP-ready


License keys for desktop apps, CLI tools, IDE extensions, and plugins. REST API documented with OpenAPI 3.1. Your AI agent (Claude Code, Cursor, ChatGPT) handles the wiring. Open-source TypeScript SDK and MCP server included. A Keygen, Cryptlex, or Lemon Squeezy alternative built for indie devs.

Managed edition not open yet · Self-hosted edition available now, MIT

  • MCP server for Claude & Cursor
  • Open spec at llms-full.txt
  • Agent telemetry: opt-in, no PII
  • Open-source SDK (MIT)
import { createClient, getFingerprint } from '@paperkeyhq/sdk';

const paperkey = createClient({ apiKey: process.env.PAPERKEY_PK! });
const fp = await getFingerprint();

const result = await paperkey.validate(licenseKey, fp.fingerprint);
if (!result.valid) throw new Error(result.error);

Waitlist

Hear when the managed edition opens

Paperkey works today as a self-hosted, MIT-licensed project. The hosted edition is not open yet and has no date. Leave your email and you will get one message when it opens.

Need it now? Self-host it from GitHub →

You will first get an email to confirm your address. It is only used for this message, kept until the opening and then deleted, and never more than three years without contact. Every email has an unsubscribe link. To ask for deletion, write to hello@paperkey.dev. Privacy policy

Inside the dashboard

You stop guessing what your licenses are doing.

Every license, every activation, every webhook delivery in one place. Search by key, by customer, by status. AI agents read the same view through the MCP server.

Why Paperkey

Two ways to ship licensing.

One takes a long prompt and a lot of luck. The other takes a package.

Vibecode a Paperkey-like

If the agent gets it right.

Use Paperkey

Done.

MCP server

Drive Paperkey from Claude or Cursor.

Drop @paperkeyhq/mcp into your AI client. Ask, list, audit, revoke in plain English, from any chat. The protocol is open, the SDK is yours.

  • 7 tools, read-by-default. Your assistant confirms before revoking. Each mutation requires explicit confirmation.
  • Stdio transport. Zero servers to run, no extra surface. Your dashboard token is the auth.
  • Bring your own model: Anthropic, OpenAI, local. The Model Context Protocol is the contract.
Read MCP docs
claude › paperkey-mcp

you show licenses with more than 5 activations this week

▾ paperkey_find_high_activation_licenses ({ threshold: 5 }) → 3 results · 47 ms

claude Found 3 licenses with more than 5 activations this week:

  • · alice@acme.example 12 act.
  • · bob@studio.example 8 act.
  • · eve@craft.example 7 act.

Want me to revoke any of these, or send a warning email first?

Everything a licensing layer should be

Predictable on purpose. Stable, affordable, extensible.

  • 01

    Validate, activate, deactivate

    Three endpoints, one SDK. Drop it in your app and forget about license servers, secrets, and rotation flows.

  • 02

    Per-machine fingerprints

    Stable identifiers across reinstalls and updates. CI mode for build pipelines. Tamper-resistant by default.

  • 03

    Built for indie speed

    Free tier of 100 licenses. Predictable pricing. No vendor calls, no enterprise sales motion.

  • 04

    Polyglot open-source SDKs

    TypeScript on npm, Python and PHP in the monorepo. Same surface, same HMAC verifier, cross-language test vector. MIT-licensed. The trust contract is the source code, not a marketing promise.

  • 05

    Rate limits built in

    Per-IP and per-license limiters out of the box. Never wake up to a brute-force on your activation endpoint.

  • 06

    Native MCP server

    Drop @paperkeyhq/mcp into Claude Desktop, Cursor, or Continue. Drive licenses, audit activations, revoke abuse, all in plain English.

POST /webhooks/keyed 200 OK

Headers

  • x-paperkey-event: license.created
  • x-paperkey-delivery: d_8a14…
  • x-paperkey-signature: a1b8e3…f02c

Body

{
  "id": "evt_4b8c9a2f…",
  "event": "license.created",
  "createdAt": "2026-04-25T12:34:56Z",
  "data": {
    "id": "clx7w8…",
    "key": "K7WX9-M3NP4-H8TRC-R2",
    "email": "customer@acme.example",
    "maxActivations": 3
  }
}
HMAC-SHA-256 verified delivered in 142 ms

Webhooks signed end-to-end

Every event ships with a signature.

Six events, one HMAC. Verify with three lines of SDK code. Auto-pause after 10 consecutive failures so a misbehaving endpoint doesn't drown your inbox.

  • license.created/revoked/reinstated/expired
  • activation.created/removed
  • 5-second timeout · per-delivery log · idempotent via delivery id
Webhook docs →

Install the MCP server in Claude Desktop and run your first action.

I want to drive Paperkey (a software-licensing API) from Claude Desktop using MCP.

Read the full integration spec first: https://paperkey.dev/llms-full.txt

Paperkey has no hosted API yet: I run my own self-hosted instance (guide: https://github.com/paperkeyhq/paperkey/blob/main/SELFHOST.md). Never use api.paperkey.dev or app.paperkey.dev.

Then:
1. Add this server to my claude_desktop_config.json (under mcpServers):
   {
     "paperkey": {
       "command": "npx",
       "args": ["-y", "@paperkeyhq/mcp"],
       "env": {
         "PAPERKEY_API_TOKEN": "<paste-my-dashboard-jwt>",
         "PAPERKEY_API_URL": "<my-instance-api-url>"
       }
     }
   }
2. Ask me for my instance's API URL (e.g. https://api.example.com) and tell me how to grab my dashboard JWT from my own dashboard (Settings → AI integrations). If I have no instance yet, walk me through the self-host guide first.
3. Tell me to fully restart Claude Desktop so the MCP server is picked up.
4. Once it's connected, create a product called "Demo App" and issue one license to me@example.com so I can verify the wiring works.

If anything fails, surface the exact MCP error and tell me how to fix it. Don't ask clarifying questions about the config; the snippet above is canonical.
Includes a link to llms-full.txt

Drop into your AI

One paste. You are integrated.

Pick your client, copy the prompt, paste it. Your client reads llms-full.txt, configures the MCP server (Claude or Cursor) or wires the SDK (no-code), and runs your first command. You stay in the loop at every step. No backend engineer required.

  • Claude Desktop: paste the MCP config, then drive Paperkey in natural language with your assistant.
  • Cursor: register the MCP server in your repo, then have your assistant write the integration code with your review.
  • Lovable, n8n, or ChatGPT: hand the spec to your assistant; it wires the SDK into your stack with you in the loop.

The integration surface is small on purpose. Here is what holds it.

Why your AI assistant (and you) can trust this

  • MCP confirms before mutation

    Tools are read-by-default. Your assistant always asks before revoking. Each write requires explicit confirmation.

  • Webhooks signed end-to-end

    HMAC-SHA-256 per delivery. 5-second timeout. Auto-pause after 10 consecutive failures.

  • Telemetry is opt-in

    AgentEvent records carry no IP, no email, no raw fingerprint. Cascade delete on owner removal.

  • Tested in the open

    203 unit + integration tests passing. Playwright E2E covers the full vendor and customer flow.

Built in public

Numbers anyone can verify.

No "trusted by" badge, no customer logos. Public source, public roadmap.

Running Paperkey on your own server?

Tell us what you ship with it at hello@paperkey.dev. Feedback from self-hosters shapes the managed edition.

Email hello@paperkey.dev

Alternatives

Coming from Keygen, Cryptlex, or Lemon Squeezy?

See the side-by-side: feature matrix, pricing models, and the integration code your AI agent will write.

  • Keygen
  • Cryptlex
  • Lemon Squeezy

Planned pricing

For the managed edition, which is not open yet. You would pay for active licenses, not seats or events. The self-hosted edition is free under MIT.

Most popular

Pro

For makers shipping to real customers.

€29 / month

Join the waitlist
  • 250 active licenses
  • Unlimited products
  • Webhook events
  • Email support

Or start smaller

  • Free

    For prototypes and side projects.

    €0
    / month
    • 100 active licenses
    • 1 product
    • Community support
    • Open-source SDK
    Join the waitlist
  • Business

    For teams scaling to many products.

    €49
    / month
    • 2,000 active licenses
    • Custom key prefix (white-label)
    • Unlimited products
    • Webhook events
    • Priority support
    Join the waitlist

Self-hosted

Available now

Run Paperkey on your own servers. Single Postgres, single Docker compose, source open. Drop the SaaS dependency the day a customer asks.

Free, MIT

Get the repo
  • Unlimited everything. No active-license cap, no per-seat surprise bill.
  • Postgres + Docker + Caddy. Your servers, your backups, your data.
  • MIT-licensed. Fork it, audit it, ship it inside an airgap.
  • Same SDK + MCP. Customers and AI agents never know the difference.

Frequently asked questions

How does Paperkey compare to Keygen, LicenseSpring, or Cryptlex?

Paperkey is opinionated for indie devs shipping local-first apps (desktop, CLI, IDE extensions, plugins): open-source SDK, predictable pricing, integration your AI agent can wire up. The competition targets enterprise, with quotes, demos, and seat-based pricing. We are deliberately not that.

Can I self-host the API?

Yes. The full monorepo (API, dashboard, marketing site) is MIT-licensed. Single Docker compose, single Postgres, no phone-home. PAPERKEY_MODE=selfhost flips Stripe and email to optional, lifts the active-license cap, and hides billing UI. See SELFHOST.md in the repo.

What counts as an "active license"?

A license that has at least one activation in the last 30 days. Revoked or expired licenses do not count.

Is the fingerprint privacy-respecting?

The SDK hashes a small set of stable system identifiers (machine ID, MAC, CPU class) and never sends raw values to our servers. CI mode swaps in environment-derived identifiers so build pipelines do not consume activations.

What happens if Paperkey disappears?

You own your data and the code. Export licenses + activations from the dashboard at any time, and the entire stack is MIT — clone the monorepo, point your SDK at your own instance, keep running. SELFHOST.md walks through the deploy.

Is the managed edition available?

Not yet. The managed edition has a waitlist on paperkey.dev and no launch date. The self-host edition is available today under the MIT license, free, with no license cap.

Who runs the API?

You do, for now. Self-host is the only edition available, so uptime depends on your own infrastructure. The SDK replays the last positive verdict for up to 72 hours when your API is unreachable.

How fast does revocation propagate?

Revocation is immediate at the API layer: the next validate call returns license_revoked, typically under one second after the dashboard click. There is no edge cache to bust. The SDK re-validates on app launch and on a schedule, so a revoked license stops working at the next online check.

Do you support offline activation?

Activation requires a network call: the server must record the new fingerprint slot. Once activated, validation is offline-tolerant: the SDK caches the last positive verdict and replays it for up to 72 hours when the API is unreachable. Authoritative negatives (revocation, expiration) are never cached. The grace window is configurable.

What happens if your servers go down?

Apps already activated keep running for up to 72 hours thanks to the SDK validate cache. With the self-hosted edition, the server is yours, on your own infrastructure, with the same API contract.

How do I migrate from Keygen, Cryptlex, or Lemon Squeezy?

Export your existing licenses and activations from the current vendor, then POST them to /licenses (we accept arbitrary key formats via the product config). The SDK in your shipped app stays the same. Email hello@paperkey.dev for a 30-minute walkthrough against your real data.

The managed edition is not open yet

Leave your email to hear when it opens. There is no date. The self-hosted edition runs today, under the MIT license.