Software Licensing for WHMCS

Software Licensing for WHMCS

This addon turns your WHMCS into a license server. You sell a product in WHMCS, it generates a license key for the customer, and the software you sell “phones home” to your WHMCS to check that the license is valid.

It protects licenses with digital signatures (the same idea banks and HTTPS use), so licenses cannot be faked — even if someone opens up your software.

1. How it works (the big picture)

• The private key stays on your WHMCS forever. It “stamps” every answer.
• The public key goes inside the software you sell. It only checks the stamp.
• Result: nobody can fake a license, because the stamp cannot be copied.

  Your customer's software                 Your WHMCS (license server)
 +------------------------+               +-------------------------+
 |  "Is license XYZ valid |   -- asks --> |  Checks the database     |
 |   for this domain?"    |               |  Signs the answer        |
 |                        |  <- answers - |  with the PRIVATE key    |
 |  Verifies the signature|               |                         |
 |  with the PUBLIC key   |               +-------------------------+
 +------------------------+

2. Requirements

• WHMCS (recent version).
• PHP 7.2 or newer with the sodium extension (almost always already enabled).
• If sodium is missing, the system still works using an older method, but digital signatures (the strongest protection) won't be active.

3. Installation

You have two folders to copy into your WHMCS installation.

1. Copy the addon module folder softwarelicensing into <whmcs>/modules/addons/ (this includes softwarelicensing.php and hooks.php).
2. Copy the server module folder softwarelicensing into <whmcs>/modules/servers/.
3. In WHMCS admin, go to Configuration → Addon Modules.
4. Find Software Licensing for WHMCS and click Activate. This creates the database tables and generates your signing keys automatically.

Your data is safe: deactivating the addon does not delete licenses.

4. Configure the addon

Go to Configuration → Addon Modules → Software Licensing for WHMCS → Configure.

After activating, this page also shows your License Signing Public Key in a box at the top. Copy it — you'll paste it into your software in step 7.

5. Create a licensed product

1. Go to Configuration → Products/Services → Products/Services.
2. Create (or edit) a product. Open the Module Settings tab.
3. Set Module Name to Software Licensing for WHMCS.
4. Fill in the options:

5. Save Changes.

Repeat this for each different software product you sell. Each product can have its own prefix, key length, and rules.

6. How a customer gets a license

This is automatic:

1. A customer orders your product in WHMCS and pays.
2. WHMCS runs Create → a unique license key is generated.
3. The customer sees their key in their client area (and you see it in the Software Licensing Manager).

The license starts in “Reissued” state, meaning “ready to be activated.” The first time the customer's software checks in, the license binds to that domain and becomes “Active.”

7. Add the license check to YOUR software

This is the part you put inside the software you sell.

1. Take the file check_sample_code.php from this package.
2. Open it and set the values at the top:

$whmcsurl   = 'https://yourwhmcs.com/';            // your WHMCS URL
$public_key = 'PASTE_THE_PUBLIC_KEY_FROM_STEP_4';  // the box on the addon page
$secret_key = '';                                  // leave empty when using the public key
$allowcheckfaildays = 3;                           // keep running this many days if your server is down

3. In your software, store two things for each customer: the license key they entered, and the local key (returned by the check — save it each time it changes).
4. Call the check and allow/block your software based on the result:

require 'check_sample_code.php';

$licenseKey = load_setting('license_key');   // your own storage
$localKey   = load_setting('local_key');

$result = check_license($licenseKey, $localKey);

if ($result['status'] === 'Active') {
    // Save the refreshed local key if it changed
    if (!empty($result['localkey']) && $result['localkey'] !== $localKey) {
        save_setting('local_key', $result['localkey']);
    }
    // let your software run
} else {
    // block it
    if ($result['status'] === 'Suspended') die('License suspended.');
    if ($result['status'] === 'Expired')   die('License expired.');
    if ($result['status'] === 'Invalid')   die('Invalid license.');
    die('License error: ' . $result['description']);
}

That's it — the function handles the network call, signature checking, offline caching, and the grace period for you.

8. Managing licenses (admin)

On a customer's service page (Module Commands buttons):

The Software Licensing Manager page: Addons → Software Licensing for WHMCS shows every license across all customers — key, domain, IP, status — plus your public key. Click Manage Service to jump to a customer's service.

9. Multi-seat (multiple installs per license)

By default, one license = one install (one domain).

To allow several installs on one license:

1. Edit the product → Module Settings.
2. Set Max Instances to the number you want (e.g. 5).

Now that license can run on up to 5 different installs at once. Each install is tracked; if one stops checking in for a while, its slot is freed automatically. The admin service page shows a list of which domains are using the license.

10. Protect your software (important)

Read this — it is essential.

PHP files are plain text. The digital signature stops people from faking a license, but it does not stop someone from simply deleting the license check from your code.

To prevent that you must encode/obfuscate the files that contain the license check and your main application logic using one of:

• ionCube Loader
• SourceGuardian
• Zend Guard

Extra tips:

• Call check_license() from several places in your code, not just one.
• Don't put the whole check behind a single obvious if — spread it out.

11. Troubleshooting

12. Glossary

• License key — the code the customer enters into your software.
• Local key — a signed “proof” the server gives back so the software can run offline for a while without re-checking every time.
• Private key — secret stamp on your WHMCS that signs answers. Never shared.
• Public key — the verify-only key you put in your software. Safe to share.
• Bind — when a license locks onto the first domain/server that activates it.
• Reissue — clearing that lock so the license can move to a new server.
• Multi-seat — allowing one license to run on several installs at once.