Getting started
Quickstart
From an empty dashboard to a signed-in user with a redeemed license key. You'll need an Aroli account - the free plan is enough.
1. Create an application
Sign in to the dashboard, open your organization and create an application. Give it the name of the product you ship and choose how many devices each user may bind.
2. Copy the app ID and public key
On the application's overview you'll find two values your software needs:
- App ID - looks like
app_8f2k1x9q. It's public and safe to embed in your binary. - Public key - the Ed25519 key your app pins to verify that responses really come from Aroli. It's also available from
GET /api/v1/client/keys, but pinning it in your build is what protects you from a spoofed server.
3. Install an SDK
# TypeScript
npm i @aroli/sdk
# Python
pip install aroli
# C++: add the aroli header to your include path and link libcurl + libsodium4. Sign in, redeem and check
Construct a client with your app ID and pinned key, sign the user in with a hardware ID, redeem their license key and check the entitlement before unlocking features.
import { Aroli, AroliError } from "@aroli/sdk";
const aroli = new Aroli({
appId: "app_8f2k1x9q", // public - safe to ship
publicKey: "<your app's Ed25519 key>", // pinned: responses are verified
});
try {
const session = await aroli.login({ username, password, hwid: machineId() });
await session.redeem(licenseKey); // binds the key to this user + device
if (!(await session.hasEntitlement("pro"))) showUpgrade();
session.startHeartbeat(); // keeps the session alive
} catch (err) {
if (err instanceof AroliError && err.code === "device_mismatch") {
showError("This account is linked to another device.");
}
}What just happened
Aroli verified the password, bound the session to the device, applied the license's time to the user's pro entitlement and returned a signed response the SDK verified against your pinned key.
5. Generate your first license key
In the dashboard, open Licenses for your application and generate a key: choose the product (for example pro), a duration (1, 7, 30, 90, 180 or 365 days, a custom length, or lifetime), the maximum number of activations and an optional prefix and label.
Copy the key now
Keys are stored only as HMAC verifiers. The plaintext is shown once when you generate it - copy it or download the CSV before leaving the page.
Prefer automation? Generate keys from your backend with POST /api/v1/management/licenses - see the management API.
Next steps
- Handle errors by their stable codes.
- Understand how time stacks and freezes.
- Get notified with webhooks.