Self-hosted license management

Your licenses.
Your server.
Your rules.

License key management that deploys in an evening. Paddle & LemonSqueezy webhooks. Ed25519 offline certificates. Native Swift & TypeScript SDKs.

ZAMOK-XXXX Key format (Crockford Base32)
Ed25519 JWS offline certificates
5 lines SDK integration

The problem

You sell a macOS app. You need license keys. Your options:

Keygen.sh

$49–299/month. Your data on someone else's server. Another bill that scales with success.

Paddle built-in

Vendor lock-in. No offline validation. Switch payment provider? Rewrite everything.

Build it yourself

2 months of work instead of building features. Key generation, validation, dashboard, webhooks, SDKs…

Zamok: deploy in an evening

Self-hosted. Open source for personal use. All the infrastructure you need, none of the vendor lock-in.

Developer setup

Five steps from zero to production.

1

Deploy Zamok

Self-hosted Next.js app. SQLite for dev, PostgreSQL for production.

2

Create a product

Choose validation strategy: online, hybrid, or offline. Set max activations.

3

Connect payment

Add Paddle or LemonSqueezy webhook. Purchases create licenses automatically.

4

Integrate SDK

5 lines of Swift or TypeScript. Keychain storage. Zero dependencies.

5

Ship

Purchases create licenses. Users enter keys. Offline certs handle the rest.

Swift SDK

import ZamokSDK

let zamok = Zamok(
  host: "licenses.yourapp.com",
  productId: "prod_xxx"
)

let result = try await zamok.activate(
  key: "ZAMOK-XXXX-XXXX-XXXX"
)

End user experience

1

Buy your app

Through Paddle or LemonSqueezy. Receives key: ZAMOK-XXXX-XXXX-XXXX

2

Enter key

SDK validates and stores a JWS certificate in Keychain

3

Works offline

Certificate validates locally. No internet needed for 1h–30 days depending on strategy

Key features

Self-hosted

Your server, your data. No vendor lock-in. No monthly fees. Deploy anywhere.

Offline certificates

Ed25519 JWS certs. Apps work without internet. Configurable TTL from 1 hour to 30 days.

Native Swift SDK

Keychain storage. Zero dependencies. macOS 13+ and iOS 16+. 5 lines to integrate.

Provider agnostic

Paddle, LemonSqueezy, or manual creation. Switch payment providers without touching your app.

Hybrid billing

Perpetual + subscription for the same product. Your business model, your choice.

Redeem keys

Generate promo keys. Crockford Base32 with Luhn checksum. Offline-verifiable format.

Validation strategies

Choose how aggressively licenses are validated.

Online

Certificate TTL 1 hour
Offline grace 0 days

Always validates with server

Hybrid

Certificate TTL 24 hours
Offline grace 7 days

Online-first with offline fallback

Offline

Certificate TTL 30 days
Offline grace 30 days

Long-lived certificates for air-gapped environments

Dashboard

Everything you need to manage licenses.

Products — validation strategy, max activations, linked providers
Licenses — active, suspended, revoked, expired. Perpetual, subscription, trial
Activations — which devices, when, deactivation
Webhooks — event log from payment providers, retry, dead-letter queue
Signing Keys — Ed25519 key management for certificate signing
Redeem Keys — generate and manage promotional keys
Users — RBAC with admin, support, and viewer roles
Cmd+K — global search across all entities

Compared to alternatives

vs Keygen.sh

Self-hosted, no monthly fee, your data stays on your server. Same capabilities, zero recurring cost.

vs Paddle built-in

Provider agnostic — switch from Paddle to LemonSqueezy without app changes. Ed25519 offline certs.

vs building your own

Zamok is already built. Dashboard, webhooks, SDKs, offline certs, redeem keys. Deploy in an evening.

Tech stack

Backend Next.js, ZenStack, BetterAuth + Passkeys
Database SQLite (dev) / PostgreSQL (prod)
Crypto Ed25519 (EdDSA), jose v6
SDKs Swift 5.9+ / TypeScript (Node 18+)
API REST v2 — activate, refresh, deactivate, signing-keys, redeem-keys
Keys ZAMOK-XXXX-XXXX-XXXX (Crockford Base32, Luhn checksum)

Currently in beta

Zamok is in active development. Join the waitlist to get notified when it's ready for self-hosting.

One BSHK waitlist across all products. Unsubscribe anytime.

Back to BSHK