Licensing
Script Licensing Explained for Developers
October 1, 2026 · 8 min read
Script licensing is how you turn code into a product: a way to sell access, control who runs it, and respond when something goes wrong. This guide explains the core concepts — license models, keys, binding, and enforcement — without assuming you've built a licensing system before.
What a license actually is
A software license is permission to use your code under specific terms. A license key is the token that represents that permission for one customer. The key itself is just a string; its value comes entirely from something that checks it and acts on the result.
That 'something' is enforcement. A license without enforcement is a promise; a license with enforcement is a control.
Common license models
- Perpetual: one payment, indefinite use. Simple, but hard to claw back without revocation.
- Subscription: time-limited access that renews. Needs expiry and renewal handling.
- Per-server / per-seat: access scoped to specific machines or servers via binding.
- Bundle: one license covering several scripts sold together as a pack.
Keys, binding, and expiry
Issue one key per customer so you can track and control each independently. Binding restricts where a key works — most commonly to specific server IPs — so a shared or leaked key fails outside its allowed scope. Expiry supports subscriptions and trials, ending access when the term does unless renewed.
These three levers — identity, binding, expiry — cover most real selling scenarios without complex custom logic.
Validation vs enforcement
Validation answers 'is this key real and active?' Enforcement answers 'and therefore, does the code run?' Many tools stop at validation and leave enforcement to code you must write and protect yourself — which is where licensing schemes usually fall apart, because the check can be patched out of readable source.
Robust licensing puts enforcement inside a protected runtime: the code is obfuscated and encrypted, delivered through a signed loader, and the loader refuses to run without a valid license. Now the check can't simply be deleted, because the thing doing the checking is also the thing that holds your protected code.
Revocation and re-issuing
Revocation is the feature you hope to rarely use and are very glad to have: after a refund, dispute, or leak, you disable a key and access ends on the next runtime start. Re-issuing covers the ordinary case of a customer losing their key — you generate a new one without disturbing their setup, and because only a hash of each key is stored, you never needed the original.
Turning a script into a product with Trust Secure
Trust Secure combines licensing with protected delivery so your keys are enforced where the code runs. You issue per-customer licenses with optional IP binding and expiry, bundle scripts into collections for pack deals, and suspend, revoke, or renew at any time. The result is a licensing operation, not just a key list.
Frequently asked questions
Do I need enforcement, or is validation enough?
Validation alone can be bypassed if your check lives in readable source. Enforcement inside a protected runtime is what makes a license actually control execution.
How do I sell several scripts as one license?
Use a bundle (collection): one license covers the whole pack, so customers manage a single key.
What if a customer loses their key?
Re-issue it. Only a hash is stored, so you generate a new key without needing the original.
Related product pages
Protect and license your scripts
Trust Secure encrypts, obfuscates, licenses, and monitors your FiveM, Lua, and JavaScript scripts.
Get started freeKeep reading
- How to Protect FiveM Lua ScriptsWhy file-level tricks aren't enough, and how encryption, obfuscation, and runtime-enforced licensing actually protect a FiveM resource.
- How to Create a License System for FiveM ScriptsWhat a license system needs beyond generating keys, and how to enforce licenses where your FiveM code actually runs.
- How Lua Script Protection WorksA clear look at the layers that keep Lua source private on machines you don't control — and the honest limits of each.