Forgebit

Software licensing built for developers

Forgebit is a software licensing platform that helps developers issue, distribute, and validate licenses without building a separate licensing system for every product.

It supports traditional online verification as well as fully offline validation, allowing licensed software to verify authenticity Forgebit is a software licensing platform that helps developers issue, distribute, and validate licenses without building a separate licensing system for each product.

It supports both traditional online verification and fully offline validation, allowing licensed software to verify authenticity without contacting Forgebit's servers. This makes it suitable for desktop applications, WordPress plugins, internal business software, self-hosted products, and systems deployed in restricted environments. This makes it suitable for desktop applications, WordPress plugins, internal business software, self-hosted products, and systems deployed in restricted environments.

The challenge

Software licensing often begins as a handful of database tables, API endpoints, and product-specific validation rules. As a product grows, that approach becomes increasingly difficult to maintain.

Different products may require different license formats, expiration policies, hardware restrictions, feature entitlements, signing keys, or offline capabilities. Developers also need a safe way to revoke licenses, rotate cryptographic keys, notify external systems, and limit administrative access between vendors.

Forgebit was created to bring those requirements together into one consistent platform.

A flexible licensing system

Forgebit uses a modular strategy architecture in which each license type is implemented independently behind a shared interface.

Supported license strategies include:

• HMAC-signed licenses
• JWT licenses signed with Ed25519 keys
• Human-readable serial licenses
• Encrypted license files
• Hardware-bound licenses
• Online and offline verification

Each product can define its own licensing behavior, while individual licenses may include expiration dates, customer information, hardware identifiers, and custom feature entitlements.

Feature values can represent simple permissions, such as can_export, or configurable limits, such as max_users.

Secure offline verification

For offline products, Forgebit generates downloadable license artifacts that can be verified locally using a vendor’s public key.

Private signing keys remain isolated by vendor, and Ed25519 keys can be rotated without invalidating the overall licensing architecture. This gives developers control over their signing infrastructure while allowing applications to validate licenses without exposing sensitive credentials.

API-first automation

Forgebit provides an API for creating, downloading, verifying, expiring, and revoking licenses.

API tokens are scoped to individual vendors and protected by abilities that restrict what each integration may perform. Roles are also assigned through vendor memberships, allowing one user to participate in multiple vendor organizations with different levels of access.

Retryable webhooks notify external applications when important license events occur, including revocation and expiration.

Technical architecture

Forgebit is built with Laravel using service classes and a strategy pattern to keep license generation and verification logic modular.

Core components include:

• Dedicated issuer and verification services
• Independent strategies for each license format
• ULIDs across primary application records
• Vendor-scoped authorization and API tokens
• Per-product configuration and feature entitlements
• Secure vendor key storage
• Queued, retryable webhook delivery
• Pest test coverage for each licensing strategy

The result is a reusable licensing foundation that can support many kinds of software without forcing every product into the same validation model.