Features
One platform for the moment between download and unlock.
Aroli handles the parts of shipping paid desktop software that nobody wants to build twice: accounts, keys, devices, time-limited access and the tooling around them.
Authentication
Accounts for your end users, without building an auth server.
Your app registers and signs in users with a username and password through the client API. Aroli returns a session token, the device it was bound to and the user's current entitlements in one response.
- Passwords hashed with Argon2id; session tokens stored only as SHA-256 hashes
- Optional email and license key at registration
- Heartbeats keep sessions alive; logout and server-side revocation end them
- Ban or disable users, with a reason, from the dashboard or the API
License management
Keys you can generate in bulk and reason about later.
Create batches of keys for a product with a duration (or lifetime), an activation limit, a label and a prefix. Keys use an unambiguous alphabet and are stored as HMAC verifiers - you see the plaintext exactly once.
- Redemption is atomic: the same key can't be redeemed twice, even under concurrent requests
- License-only mode validates a key and hardware ID without any user account
- Revoking a key withdraws only the time that key granted
- Export new keys as CSV when you generate them
Device binding
One account, a sensible number of machines.
Each application sets how many devices a user or key may be bound to. When a new hardware ID shows up, Aroli checks the limit on the server and returns a clear error code if it's exceeded.
- Configurable per application
- device_mismatch and device_limit_reached error codes your UI can act on
- Deactivate a device from the client, or reset all of a user's devices from your backend
- Hardware IDs are stored hashed with a per-app salt
Subscriptions & entitlements
Time that stacks, pauses and adds up - correctly.
Entitlements are computed from an append-only ledger of grants. Timed grants queue behind each other instead of overlapping, lifetime grants win, and freezing pauses the clock.
- Durations of 1, 7, 30, 90, 180 or 365 days - or any custom length
- Freeze and unfreeze without losing a single day
- Grant time manually with a note, or by redeeming a key
- Check access with one call: hasEntitlement("pro")
Developer SDKs
TypeScript, Python and C++ - the same concepts everywhere.
The SDKs wrap the client API, pin your app's public key, verify each response signature and turn errors into exceptions with stable codes.
- npm i @aroli/sdk
- pip install aroli
- C++ header using libcurl and libsodium
- Plain HTTPS + JSON for any other language
API management
A management API your backend can trust.
Automate everything you can do in the dashboard from your own servers with scoped secret keys. Writes accept an Idempotency-Key so retries never double-apply.
- Separate development (ak_dev_…) and live (ak_live_…) keys
- Scopes such as users:write or licenses:read limit each key
- Keys are hashed at rest and can be revoked at any time
- An OpenAPI description you can generate clients from
Webhooks
Know the moment something changes.
Subscribe an HTTPS endpoint to events such as user.registered, license.redeemed or entitlement.changed. Every delivery is signed so you can verify it came from Aroli.
- HMAC-SHA256 signatures with a per-endpoint secret
- Automatic retries with exponential backoff, up to 8 attempts
- Private and loopback addresses are rejected
- Every delivery attempt is recorded
Analytics
See usage before it surprises you.
Track API request volume and how close each resource is to your plan's limits, so you can upgrade on your schedule - not when a request fails.
- API requests per month against your plan
- Plan limits enforced with a clear plan_limit_reached error
- Request IDs on every call for support and debugging
Team management
Bring your team, keep control.
Invite colleagues into your organization with a role that fits what they do. Every administrative action lands in the audit log.
- Owner, Admin, Developer, Support and Viewer roles
- Optional TOTP two-factor authentication with recovery codes
- Audit log of who changed what, and when
See it with your own app.
Create an application, connect an SDK and issue your first license key. The free plan has everything you need to build and test your integration.