Get started
Introduction
What Keyrail does, the moving parts, and where to start.
Keyrail is a hosted licensing service for desktop software. It sits between your payment provider and your app:
- Your customer buys through Paddle Billing or Lemon Squeezy. The provider sends a webhook to Keyrail.
- Keyrail creates (or renews, suspends, refunds…) a license and emails the license key to your customer.
- Your app sends the key once to the client API. Keyrail records a machine activation and returns a certificate: a small statement signed with your product’s Ed25519 key.
- Your app verifies the certificate offline at every launch, and refreshes it silently when the network is available.
There is no secret in your app and no server for you to run. If Keyrail is unreachable, apps that activated once keep working for the certificate’s offline window (30 days by default).
The pieces#
| Piece | Used by | Auth | Docs |
|---|---|---|---|
Client API (https://api.keyrail.tech/v1/licenses/…) | Your app, through an SDK | None (public product ID) | Client API |
Vendor API (https://api.keyrail.tech/v1/…) | Your backend, scripts, the dashboard | Bearer kr_sk_… secret key | Vendor API |
| Webhook endpoints | Paddle, Lemon Squeezy | Provider signature | Webhooks |
Dashboard (https://keyrail.tech/app) | You and your team | Email sign-in link | Dashboard guide |
Customer portal (https://keyrail.tech/portal/{accountSlug}) | Your customers | Email sign-in link | Customer portal |
| SDKs | Your app | — | Quickstarts below |
SDKs#
| Stack | Packages | License |
|---|---|---|
| Tauri 2 | tauri-plugin-keyrail (crate) + @keyrail/tauri-plugin (npm) | MIT or Apache-2.0 |
| Electron, Node | @keyrail/client (npm, zero runtime dependency) | MIT |
| Rust, native | keyrail (crate) | MIT or Apache-2.0 |
| .NET | Planned | — |
Another language? The client API is three JSON endpoints, and the certificate format is documented with test vectors, so you can write a verifier in an afternoon.
Where to start#
- New here? Follow the quickstart for your stack (Tauri, Electron, Rust), with the Get started checklist of the dashboard open next to it. The dashboard guide explains every screen.
- Selling soon? Connect Paddle Billing or Lemon Squeezy, then go through the going-live checklist.
- Something not working? Troubleshooting lists every error code and the usual fixes. To search the docs, press
/or Ctrl+K (⌘K on a Mac).
Get startedQuickstart for TauriAdd license keys and offline activation to a Tauri 2 app with tauri-plugin-keyrail.Get startedQuickstart for ElectronLicense an Electron app with @keyrail/client in the main process, exposed to the renderer over IPC.Get startedQuickstart for RustUse the keyrail crate in any Rust desktop app or CLI: the License helper, or verification only.ConceptsConceptsProducts, plans, licenses, activations, statuses and the grace period: the vocabulary of every API and SDK.ConceptsOffline certificatesThe KR1 certificate format, the verification rules every SDK applies, key rotation and the public test vectors.PaymentsConnect Paddle BillingCreate licenses automatically from Paddle Billing transactions, subscriptions and refunds.PaymentsConnect Lemon SqueezyCreate licenses automatically from Lemon Squeezy orders and subscriptions, with offline certificates.PaymentsWebhooksHow Keyrail receives, verifies and processes payment provider webhooks, and what it answers.GuidesDashboard guideEvery screen of the Keyrail dashboard, what it is for, what you can do there and what each setting means.GuidesGoing-live checklistEverything to check before real customers pay: from sandbox and test mode to a live integration, a tested purchase and your customer emails.GuidesTroubleshooting and error codesEvery client API, SDK and vendor API error code, what to tell your customer, and fixes for the most common problems.ReferenceClient API referenceThe three public endpoints your app calls to activate, validate and deactivate a license. No secret needed.ReferenceVendor API referenceManage products, plans, licenses, activations, customers, integrations and API keys with a secret key.MoreCustomer portalA hosted page, on your own domain and under your brand, where your customers find their license keys and free their machines without emailing you.MoreCustom sender and languagesSend license keys from your own address, in your customers' language, with or without the Keyrail portal.MoreSecurityThe threat model behind Keyrail licensing, what each part protects against, and how to integrate it safely.MoreFAQShort answers to common integration questions: offline use, virtual machines, reinstalls, trials, upgrades and more.
Need help? See Troubleshooting or write to support@keyrail.tech.