A naive system checks $_POST['key'] == DB('key'). A hacker can simply modify your PHP code to return true;. Solution: Use IonCube encoding, or better, offload critical logic to the remote server (e.g., don't just check a flag; fetch actual data from the server).
php-license-key-system/ ├── api/ │ ├── generate.php │ ├── validate.php │ └── status.php ├── database/ │ └── license.sql ├── includes/ │ ├── config.php │ └── License.php ├── examples/ │ ├── client-example.php │ └── admin-generate.php └── README.md
## Installation
git clone https://github.com/yourusername/php-license-key-system.git
</code></pre>
<ol start="2">
<li>
<p>Import <code>database/license.sql</code> into your MySQL database.</p>
</li>
<li>
<p>Update <code>includes/config.php</code> with your database credentials.</p>
</li>
</ol>
<h2>Database Schema</h2>
<pre><code class="language-sql">CREATE TABLE `licenses` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`license_key` varchar(64) NOT NULL,
`product_id` int(11) DEFAULT 1,
`customer_email` varchar(255) DEFAULT NULL,
`domain` varchar(255) DEFAULT NULL,
`expires_on` date DEFAULT NULL,
`status` enum('active','expired','blocked') DEFAULT 'active',
`created_at` timestamp NOT NULL DEFAULT current_timestamp(),
PRIMARY KEY (`id`),
UNIQUE KEY `license_key` (`license_key`)
);
</code></pre>
<h2>API Usage</h2>
<h3>Generate License</h3>
<pre><code>POST /api/generate.php
</code></pre>
<p>Params: <code>product_id</code>, <code>customer_email</code>, <code>expires_days</code>, <code>domain</code></p>
<h3>Validate License</h3>
<pre><code>GET /api/validate.php?license_key=XXXX&domain=example.com
</code></pre>
<p>Response: <code> valid: true, message: "License is active", expires_on: "2025-12-31" </code></p>
<h2>Example Client Code</h2>
<pre><code class="language-php"><?php
$licenseKey = "USER_INPUT_KEY";
$domain = $_SERVER['HTTP_HOST'];
$response = file_get_contents("https://your-server.com/api/validate.php?license_key=$licenseKey&domain=$domain");
$data = json_decode($response, true);
if ($data['valid'])
echo "✅ License valid until " . $data['expires_on'];
else
echo "❌ " . $data['message'];
?>
</code></pre>
<h2>Security Notes</h2>
<ul>
<li>Always validate licenses server-side.</li>
<li>Use HTTPS for API calls.</li>
<li>Hash license keys before storing in DB (we provide <code>hash_hmac</code> example).</li>
<li>Optionally implement IP whitelisting.</li>
</ul>
<h2>License</h2>
<p>MIT – Use freely for personal/commercial projects.</p>
<pre><code>
---
## 🔧 Core PHP Files
### `includes/config.php`
```php
<?php
define('DB_HOST', 'localhost');
define('DB_NAME', 'license_db');
define('DB_USER', 'root');
define('DB_PASS', '');
define('SECRET_KEY', 'your-strong-secret-key-here'); // used for hashing
try
$pdo = new PDO("mysql:host=" . DB_HOST . ";dbname=" . DB_NAME, DB_USER, DB_PASS);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
catch(PDOException $e)
die("Database connection failed: " . $e->getMessage());
?>
</code></pre>
<h3><code>includes/License.php</code></h3>
<pre><code class="language-php"><?php
class License
private $db;
public function __construct($pdo)
$this->db = $pdo;
public function generate($productId, $email, $expiresDays, $domain = null)
$licenseKey = bin2hex(random_bytes(16)) . '-' . strtoupper(bin2hex(random_bytes(4)));
$expiresOn = date('Y-m-d', strtotime("+$expiresDays days"));
$stmt = $this->db->prepare("INSERT INTO licenses (license_key, product_id, customer_email, domain, expires_on) VALUES (?, ?, ?, ?, ?)");
$stmt->execute([$licenseKey, $productId, $email, $domain, $expiresOn]);
return ['license_key' => $licenseKey, 'expires_on' => $expiresOn];
public function validate($licenseKey, $domain = null)
$stmt = $this->db->prepare("SELECT * FROM licenses WHERE license_key = ?");
$stmt->execute([$licenseKey]);
$license = $stmt->fetch(PDO::FETCH_ASSOC);
if (!$license)
return ['valid' => false, 'message' => 'License key not found'];
if ($license['status'] === 'blocked')
return ['valid' => false, 'message' => 'License key blocked'];
if ($license['expires_on'] < date('Y-m-d'))
return ['valid' => false, 'message' => 'License expired'];
if ($license['domain'] && $license['domain'] !== $domain)
return ['valid' => false, 'message' => 'Invalid domain for this license'];
return [
'valid' => true,
'message' => 'License is active',
'expires_on' => $license['expires_on']
];
?>
</code></pre>
<h3><code>api/generate.php</code></h3>
<pre><code class="language-php"><?php
require_once '../includes/config.php';
require_once '../includes/License.php';
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST')
http_response_code(405);
echo json_encode(['error' => 'Method not allowed']);
exit;
$productId = $_POST['product_id'] ?? 1;
$email = $_POST['customer_email'] ?? null;
$expiresDays = $_POST['expires_days'] ?? 365;
$domain = $_POST['domain'] ?? null;
$licenseSys = new License($pdo);
$result = $licenseSys->generate($productId, $email, $expiresDays, $domain);
echo json_encode(['success' => true, 'data' => $result]);
?>
</code></pre>
<h3><code>api/validate.php</code></h3>
<pre><code class="language-php"><?php
require_once '../includes/config.php';
require_once '../includes/License.php';
header('Content-Type: application/json');
$licenseKey = $_GET['license_key'] ?? null;
$domain = $_GET['domain'] ?? null;
if (!$licenseKey)
echo json_encode(['valid' => false, 'message' => 'License key required']);
exit;
$licenseSys = new License($pdo);
$result = $licenseSys->validate($licenseKey, $domain);
echo json_encode($result);
?>
</code></pre>
<hr>
<h2>✅ Next Steps for Your GitHub Repo</h2>
<ol>
<li>Create the repo: <code>php-license-key-system</code></li>
<li>Add the files above</li>
<li>Push to GitHub</li>
<li>Add a <code>LICENSE</code> file (MIT)</li>
<li>Optional: Add a demo GIF or badge for PHP version</li>
</ol>
This article explores how to implement or find a PHP license key system using GitHub as a resource. We’ll cover why you’d want one, how to find open-source options on GitHub, and the basic logic behind building your own. Building and Finding a PHP License Key System via GitHub
If you are developing premium PHP plugins, themes, or SaaS applications, protecting your intellectual property is a top priority. A PHP license key system allows you to control who uses your software, manage subscriptions, and prevent unauthorized distribution.
GitHub is the ultimate hub for finding both ready-made libraries and inspiration for building your own licensing logic. Why Use a License Key System?
Revenue Protection: Ensures only paying customers can access full features or updates.
Version Control: Restrict certain features to "Pro" vs "Lite" versions.
Remote Deactivation: Revoke access if a refund is issued or a subscription expires. php license key system github
Usage Analytics: Track which versions of your software are most popular. Finding Open-Source Solutions on GitHub
Instead of reinventing the wheel, many developers turn to GitHub to find maintained licensing frameworks. When searching for php license key system on GitHub, you will generally find three types of repositories: 1. Client-Side Libraries
These are small PHP scripts you include in your application. They "call home" to a server to verify if a key is valid. Pros: Easy to integrate. Cons: Requires a backend server to handle the requests. 2. Full-Stack Managers
These repositories include both the Server (where you generate keys and manage customers) and the Client (the code that goes into your product).
Search Tip: Look for "Software License Manager" or "WooCommerce License Manager" if you use WordPress. 3. Key Generators
Simple scripts that use algorithms (like Hashids or UUIDs) to create unique, hard-to-guess strings. How a Basic PHP Licensing System Works
If you decide to build a custom solution inspired by GitHub projects, the logic usually follows these four steps: Step 1: Key Generation On your server, you generate a unique string.
To implement a PHP license key system, you can use existing GitHub projects to handle key generation, server-side management, or client-side activation. 1. Key Generation Libraries A naive system checks $_POST['key'] == DB('key')
For creating unique and secure license keys, these lightweight libraries offer customizable formats:
PHP-License-Key-Generator: A simple class for creating random, unique keys with user-defined prefixes and templates (e.g., AA9A9A-AA-99).
Keygen-PHP: A fluent random key generator that can produce numeric, alphanumeric, or custom-sequenced keys.
PHP-License: Uses RSA key pairs (public/private keys) to generate and parse cryptographically signed licenses, ensuring they cannot be easily forged. 2. Full License Management Systems
If you need a complete backend to manage users, activations, and expirations, consider these open-source frameworks:
LicenseKeys: A Laravel-based application that provides a full dashboard for developers to manage application licenses without building a system from scratch.
LicenseGuard: A comprehensive management tool that includes an admin panel, email verification, and cron job support for automated tasks.
Laravel-Licensing: An enterprise-grade package supporting seat-based limits, offline verification via PASETO tokens, and full audit trails. 3. Remote Activation Examples For projects that require "calling home" to verify a key: ## Installation
Keygen.sh PHP Example: Demonstrates how to build an activation server that handles machine fingerprints and license validation.
KeyAuth PHP Example: Provides a ready-to-use client-side integration for the KeyAuth authentication system, including registration and login via license keys. Implementation Workflow
Implementing a PHP license key system involves using server-side validation to manage key generation, activation with hardware ID (HWID) locking, and validation. Top GitHub solutions include KeyAuth for comprehensive management, Laravel Licensing for offline verification, and Keygen.sh for secure, machine-fingerprinted activations. For more details, explore the Keygen.sh example repository masterix21/laravel-licensing - GitHub
When your app “phones home,” use a shared secret to sign requests. Otherwise, attackers can replay old valid responses.
A PHP License Key System allows developers to distribute PHP applications (WordPress plugins, SaaS scripts, or standalone PHP apps) while restricting usage to authorized users. GitHub hosts numerous solutions ranging from simple "key generators" to full-fledged licensing servers.
This report finds that while many repositories exist, most are unmaintained or lack security hardening. For a "proper" implementation, developers should look for systems that implement RSA Signing (Asymmetric Encryption) rather than simple string matching, and separate the licensing server from the distributed application.
If the client communicates with your server over HTTP (non-SSL), a hacker can intercept the request and return a fake "Valid" response.
Mitigation: Enforce HTTPS (SSL) on the licensing server and use certificate pinning within the PHP client code if possible.
Most popular repositories (like the now-legendary PHP-Licensing-System by various independent authors) rely on a singular, terrifying concept: Obfuscation.
The interesting part isn't the license validation itself—it’s the lengths the code goes to hide the validation.