PHPackages masterix21/laravel-licensing - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. masterix21/laravel-licensing ActiveLibrary[Authentication & Authorization](/categories/authentication) masterix21/laravel-licensing ============================ Laravel licensing package with polymorphic assignment to any model, activation keys, expirations/renewals, and seat control via LicenseUsage. Supports offline verification with public-key–signed tokens, a CLI to generate/rotate/revoke keys, and an extensible architecture via config and contracts. 2.2.0(1w ago)1563.0k↑2620%18[1 PRs](https://github.com/masterix21/laravel-licensing/pulls)2MITPHPPHP ^8.3CI passing Since Sep 15Pushed 1w ago3 watchersCompare [ Source](https://github.com/masterix21/laravel-licensing)[ Packagist](https://packagist.org/packages/masterix21/laravel-licensing)[ Docs](https://github.com/masterix21/laravel-licensing)[ GitHub Sponsors](https://github.com/masterix21)[ RSS](/packages/masterix21-laravel-licensing/feed)WikiDiscussions main Synced today READMEChangelog (10)Dependencies (84)Versions (15)Used By (2) Laravel Licensing ================= [](#laravel-licensing) [![Latest Version on Packagist](https://camo.githubusercontent.com/aa4a556d1a13ccf015ef401ca8f7c5fa2933d3797a2cdc81139e7013084a91a0/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6d6173746572697832312f6c61726176656c2d6c6963656e73696e672e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/masterix21/laravel-licensing)[![GitHub Tests Action Status](https://camo.githubusercontent.com/2438fe0a0f920f1179fbff21fab054c0e7cf0f06baba1c5a4b4c5d1432cb5a79/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f6d6173746572697832312f6c61726176656c2d6c6963656e73696e672f72756e2d74657374732e796d6c3f6272616e63683d6d61696e266c6162656c3d7465737473267374796c653d666c61742d737175617265)](https://github.com/masterix21/laravel-licensing/actions?query=workflow%3Arun-tests+branch%3Amain)[![Total Downloads](https://camo.githubusercontent.com/1f0a8bb4f7bd36efe5049d77f1238136cf677d43ed181f68a3f2e379c3d7816f/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6d6173746572697832312f6c61726176656c2d6c6963656e73696e672e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/masterix21/laravel-licensing) A licensing package for Laravel with offline verification, seat management, cryptographic key rotation, and multi-product support. Features -------- [](#features) - **Offline verification** — PASETO v4 tokens signed with Ed25519, verifiable without a server connection - **Seat-based licensing** — control how many devices, users, or instances can use a license - **Full lifecycle management** — activation, renewal, grace periods, expiration, suspension - **Multi-product scopes** — isolate signing keys per product so a compromise doesn't spread - **Two-level key hierarchy** — root CA signs short-lived signing keys; rotate without breaking clients - **Audit trail** — append-only log of every license, usage, and key event - **Polymorphic assignment** — attach a license to any Eloquent model - **Flexible key management** — auto-generation, custom keys, encrypted storage with optional retrieval Requirements ------------ [](#requirements) - PHP 8.3+ - Laravel 12 or 13 - `ext-openssl` and `ext-sodium` Installation ------------ [](#installation) ``` composer require masterix21/laravel-licensing ``` Publish config and migrations, then migrate: ``` php artisan vendor:publish --provider="LucaLongo\Licensing\LicensingServiceProvider" php artisan migrate ``` Generate your root key and first signing key: ``` php artisan licensing:keys:make-root php artisan licensing:keys:issue-signing --kid signing-key-1 ``` > The root key is encrypted with the passphrase from the `LICENSING_KEY_PASSPHRASE` env variable. If missing, the command will prompt you to set one (unless running with `--no-interaction`). ### MySQL / MariaDB notes [](#mysql--mariadb-notes) Migrations are tested against MySQL 8 and MariaDB 11 in CI. Two points worth knowing if you run into errors on older setups: - **Identifier 1059 errors** (`Identifier name '…' is too long`): the package already ships explicit short names for the only composite indexes that would exceed MySQL's 64-char limit. If you add custom migrations on top, remember to pass a short alias to `morphs()` / `index()` when the auto-generated name would overflow. - **Key length 1071 errors** (`Specified key was too long`): only relevant on MySQL < 5.7 or MariaDB < 10.2 with InnoDB's old row format. Add `Schema::defaultStringLength(191);` in your `AppServiceProvider::boot()` as per the [Laravel docs](https://laravel.com/docs/migrations#index-lengths-mysql-mariadb). This is unrelated to identifier length — it caps the indexed VARCHAR prefix, not the index name. Upgrading --------- [](#upgrading) See [UPGRADE.md](UPGRADE.md) for version-specific upgrade notes. **2.2.0** ships security and correctness fixes: - **Offline token forgery fixed** — `verifyOffline()` now cross-checks (constant-time) that the certificate binds the exact signing key used to verify the token, rejecting forged tokens that paired a genuine certificate with an attacker key. - **Audit chain hardened** — the tamper-evident hash now covers the forensic attribution columns (`actor`, `ip`, `user_agent`, `occurred_at`, …). **This changes the hash formula**, so existing audit chains re-base from the upgrade point — see [UPGRADE.md](UPGRADE.md#audit-chain-hash-formula-changed). - **Seat re-activation fixed** — re-registering a previously revoked device no longer fails with `FINGERPRINT_CONFLICT`. - **Legacy key decryption fixed** — v1 keys whose nonce happened to start with the v2 marker byte now decrypt correctly. No public API changed; the only migration concern is the audit-chain re-base above. Quick Start ----------- [](#quick-start) ### Create and activate a license [](#create-and-activate-a-license) ``` use LucaLongo\Licensing\Models\License; $license = License::createWithKey([ 'licensable_type' => User::class, 'licensable_id' => $user->id, 'max_usages' => 5, 'expires_at' => now()->addYear(), ]); // The plain-text key is available right after creation $licenseKey = $license->license_key; // e.g. "LIC-A3F2-B9K1-C4D8-E5H7" $license->activate(); ``` You can also pass your own key as second argument to `createWithKey()`, or use the lower-level `License::create()` with a pre-hashed key via `License::hashKey()`. ### Register a device (seat) [](#register-a-device-seat) ``` use LucaLongo\Licensing\Facades\Licensing; $usage = Licensing::register( $license, 'device-fingerprint-hash', ['device_name' => 'MacBook Pro'] ); ``` ### Issue an offline token [](#issue-an-offline-token) ``` $token = Licensing::issueToken($license, $usage, [ 'ttl_days' => 7, ]); ``` ### Check license status [](#check-license-status) ``` if ($license->isUsable()) { $remainingDays = $license->daysUntilExpiration(); $availableSeats = $license->getAvailableSeats(); } ``` ### Key retrieval and regeneration [](#key-retrieval-and-regeneration) ``` $originalKey = $license->retrieveKey(); // if encrypted storage is enabled $newKey = $license->regenerateKey(); // old key stops working $isValid = $license->verifyKey($providedKey); $license = License::findByKey($licenseKey); ``` Multi-Product Scopes -------------------- [](#multi-product-scopes) Scopes let you manage multiple products with independent signing keys and rotation schedules. ``` use LucaLongo\Licensing\Models\LicenseScope; $scope = LicenseScope::create([ 'name' => 'ERP System', 'slug' => 'erp-system', 'identifier' => 'com.company.erp', 'key_rotation_days' => 90, 'default_max_usages' => 100, ]); ``` Issue a signing key for this scope: ``` php artisan licensing:keys:issue-signing --scope erp-system --kid erp-key-2024 ``` When you create a license with a `license_scope_id`, tokens are automatically signed with the scope's key. A compromised key in one scope doesn't affect the others. Key Management -------------- [](#key-management) Key generation, retrieval, and regeneration are handled by pluggable services: ``` // config/licensing.php 'services' => [ 'key_generator' => \LucaLongo\Licensing\Services\EncryptedLicenseKeyGenerator::class, 'key_retriever' => \LucaLongo\Licensing\Services\EncryptedLicenseKeyRetriever::class, 'key_regenerator' => \LucaLongo\Licensing\Services\EncryptedLicenseKeyRegenerator::class, ], ``` Implement `LicenseKeyGeneratorContract` (or the retriever/regenerator contracts) to plug in your own logic. Related Packages ---------------- [](#related-packages) PackageDescription[laravel-licensing-client](https://github.com/masterix21/laravel-licensing-client)Client package for validating licenses against a server — offline verification, usage registration, route middleware[laravel-licensing-filament-manager](https://github.com/masterix21/laravel-licensing-filament-manager)Filament admin panel for license management, usage monitoring, key rotation, and audit trailTesting ------- [](#testing) ``` composer test # run tests composer test-coverage # with coverage composer analyse # static analysis ``` Laravel Boost integration ------------------------- [](#laravel-boost-integration) This package ships AI guidelines under `resources/boost/guidelines/laravel-licensing/core.blade.php`. Apps using [Laravel Boost](https://github.com/laravel/boost) auto-discover them: ``` php artisan boost:install # first time, or php artisan boost:update --discover # to pick up after adding the package ``` The guidelines cover: core concepts, licenses, usages/seats, scopes & templates, trials, offline tokens, CLI, and API/security. AI assistants (Claude Code, Copilot, Cursor, …) will follow them when generating code against `laravel-licensing`. > **Heads up:** `boost:update --discover` uses an interactive multi-select. On a TTY, select `masterix21/laravel-licensing` when prompted. In non-interactive environments (CI, automation), the prompt is silently skipped and the package is **not** added — append it manually to `boost.json`: > > ``` > { > "packages": ["masterix21/laravel-licensing"] > } > ``` > > > > then re-run `php artisan boost:update --no-interaction`. To verify the integration end-to-end against a throwaway Laravel app, run `scripts/test-boost-e2e.sh` from the package root. Documentation ------------- [](#documentation) Full documentation is available in the [docs](docs/README.md) folder. Sponsor ------- [](#sponsor) If this package is useful to you, consider [sponsoring its development](https://github.com/sponsors/masterix21). Contributing ------------ [](#contributing) Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for details. Security -------- [](#security) If you discover a security vulnerability, please email instead of using the issue tracker. License ------- [](#license) MIT. See [LICENSE.md](LICENSE.md). Credits ------- [](#credits) - [Luca Longo](https://github.com/masterix21) - [All Contributors](../../contributors) ### Health Score 58 — FairBetter than 98% of packages Maintenance98 Actively maintained with recent releases Popularity41 Moderate usage in the ecosystem Community22 Small or concentrated contributor base Maturity59 Maturing project, gaining track record Bus Factor1 Top contributor holds 93.6% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~25 days Recently: every ~18 days Total 12 Last Release 9d ago Major Versions 1.1.0 → 2.0.02026-04-08 PHP version history (2 changes)1.0.0PHP ^8.2 1.0.2PHP ^8.3 ### Community Maintainers ![](https://www.gravatar.com/avatar/177020fc4adb5c08acee3e6fe0b65002a96665c5d5c522a3ef009b4105fd634f?d=identicon)[masterix](/maintainers/masterix) --- Top Contributors [![masterix21](https://avatars.githubusercontent.com/u/6555012?v=4)](https://github.com/masterix21 "masterix21 (131 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (7 commits)")[![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)](https://github.com/github-actions[bot] "github-actions[bot] (2 commits)") --- Tags laravellicensinglicensing-as-a-servicelicensing-serverlaravelLuca Longolaravel-licensing ### Code Quality TestsPest Static AnalysisPHPStan Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/masterix21-laravel-licensing/health.svg) ``` [![Health](https://phpackages.com/badges/masterix21-laravel-licensing/health.svg)](https://phpackages.com/packages/masterix21-laravel-licensing) ``` ### Alternatives [psalm/plugin-laravel Psalm plugin for Laravel 3355.3M346](/packages/psalm-plugin-laravel)[larastan/larastan Larastan - Discover bugs in your code without running it. A phpstan/phpstan extension for Laravel 6.5k55.4M8.4k](/packages/larastan-larastan)[laravel/cashier Laravel Cashier provides an expressive, fluent interface to Stripe's subscription billing services. 2.6k29.9M146](/packages/laravel-cashier)[laravel/ai The official AI SDK for Laravel. 1.0k3.2M194](/packages/laravel-ai)[laravel/mcp Rapidly build MCP servers for your Laravel applications. 77022.3M151](/packages/laravel-mcp)[spatie/laravel-health Monitor the health of a Laravel application 87512.0M165](/packages/spatie-laravel-health) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)