How to Implement Software Licensing in JavaScript and Node.js

The netlicensing-client npm package works in Node.js services, Electron apps and the browser, and it comes with TypeScript types. Install it, create a Context with your API key, and call LicenseeService.validate(...) with the customer’s licensee number.

Install

npm install netlicensing-client

In a web page without a bundler, load a released version from a CDN as described in the client README.

Validate a customer

import {
  Context,
  LicenseeService,
  SecurityMode,
  ValidationParameters,
} from 'netlicensing-client';

const context = Context()
  .setBaseUrl('https://go.netlicensing.io/core/v2/rest')
  .setSecurityMode(SecurityMode.APIKEY_IDENTIFICATION)
  .setApiKey(process.env.NETLICENSING_API_KEY); // role ROLE_APIKEY_LICENSEE

export async function isLicensed(licenseeNumber) {
  const parameters = ValidationParameters()
    .setProductNumber('YOUR_PRODUCT_NUMBER'); // needed only for licensee auto-create

  const result = await LicenseeService.validate(context, licenseeNumber, parameters);
  const module = result.getProductModuleValidation('YOUR_PRODUCT_MODULE_NUMBER');

  return String(module?.valid) === 'true';
}

module holds everything the licensing model returns, such as expires, evaluationExpires or remainingQuantity.

Floating sessions

With Floating licenses, check out a session when the user starts working and check it back in when they’re done:

const checkOut = ValidationParameters().setProductModuleValidationParameters('M-FLOAT', {
  sessionId: sessionId,   // unique per user, host or app instance; generated by your application
  action: 'checkOut',
});
const result = await LicenseeService.validate(context, licenseeNumber, checkOut);

// later, on exit
await LicenseeService.validate(
  context,
  licenseeNumber,
  ValidationParameters().setProductModuleValidationParameters('M-FLOAT', { sessionId, action: 'checkIn' }),
);

Check out again before expirationTimestamp to hold on to the session. If you don’t, the seat is released after the module’s maxCheckoutValidity.

Cache the result

result.getTtl() tells you how long the result stays good. In a Node.js service, keep one cached result per licensee and only validate again once the TTL has passed, rather than calling the API on every request.

Security notes

Everything in a browser bundle is public, the API key included. Only ever put a key with the role ROLE_APIKEY_LICENSEE there, and make the licensing decisions that really matter on your server.

Electron and other desktop apps can be modified by the user too. Validate on your back end where you can. If you need signed responses, note that signature checking is currently built into the Java and C# clients, not this one (see response signing).

On a Node.js server, read the API key from the environment or a secret store rather than hard-coding it.