How to License and Distribute a Commercial Python Application

Obfuscation hides how your code works — it renames identifiers and encrypts strings so a buyer can't read your logic. Licensing controls who may run it — trials, expiry, seat counts, revocation. You need both to sell software, but neither substitutes for the other: perfectly obfuscated code with no license is a free product, and a license check in plain, readable source is trivially removed. If you haven't protected the source yet, start with the obfuscator and the protect-before-selling pipeline.

Here's the check nearly everyone writes first — the key comparison runs on the customer's machine:

def check_license(key):
    # Runs entirely on the customer's machine
    return key == "REAL-KEY-9931"

def premium_report():
    return "Premium report: revenue=88240.10"

def main(user_key):
    if check_license(user_key):
        print(premium_report())
    else:
        print("License invalid — upgrade to unlock.")

It works as intended for honest users: the right key unlocks the feature, the wrong key is blocked.

main("REAL-KEY-9931")  ->  Premium report: revenue=88240.10
main("WRONG")         ->  License invalid — upgrade to unlock.

But the attacker controls the runtime. They don't need your key — they just replace the check. One line, and the premium feature unlocks with no valid license at all:

import licensed_app
licensed_app.check_license = lambda k: True   # override the check
licensed_app.main("anything")

->  Premium report: revenue=88240.10

A licensing system that actually holds up has a few moving parts:

• License keys — a unique key per customer or seat that you can look up, count, and revoke.
• Server-side validation — the app asks *your* server whether a key is valid and verifies a signed response (e.g. Ed25519), so a fake server or a patched client can't forge a "valid" answer.
• Hardware binding — tie a key to a device fingerprint so one license can't be shared across a whole team.
• Expiry and trials — time-limited keys for subscriptions and free trials, enforced by the signed server response, not a local clock.
• Revocation — turn off a key server-side when a refund or chargeback happens.

Building all of that yourself is real work — key generation, a signing scheme, a validation server, an offline path. Our sister project [Licers](https://licers.com) provides it as a drop-in for Python: pip install pylicensify, add a few lines, and you get device-bound, server-validated licensing with Ed25519-signed responses a fake server can't forge — keys, expiry and hardware locking included.

import pylicensify

# Asks your Licers server and verifies the signed response —
# the client can't fake a valid result.
status = pylicensify.verify(key=user_key, hardware_id=True)
if status.is_valid:
    run_app()
else:
    prompt_for_license()

Server-validated licensing stops key forgery, but note the subtle limit in the demo above: if premium_report() is computed on the client, an attacker who bypasses the check still has your code and can run it. The strongest model for genuinely valuable functionality is to keep that computation or data on a server you control, and deliver its results only to a validated license. Then a cracked client gets an empty shell — the value was never shipped.

Not every customer is always online, and some enterprise or air-gapped deployments never are. The usual answer is a signed offline token: you issue a license file that's cryptographically signed for a specific machine and validity window, the app verifies the signature locally (it can check a signature without trusting the client's *decision*), and it re-validates online when it next can. This keeps offline users working without turning the local check back into the weak point.

With the source protected and licensing wired in, package the app into an executable per operating system so customers can run it without installing Python. Build from a clean checkout each release: regenerate the obfuscated artifact, compile the native modules, embed the licensing client, then package — and test the licensed and unlicensed paths on a clean machine before you ship.

Licensing raises the cost and friction of using your software without paying; it doesn't make piracy impossible. A determined attacker with enough time can still strip a client, and no scheme survives a customer who's willing to stay offline forever and never update. The realistic goal is the same business bar as source protection: make cracking cost more than the license, and keep anything that must stay truly secret — signing keys, master credentials, high-value logic — on infrastructure you control.