Authentication, licensing, and releases for desktop software

Ship the app.
Keep the authority.

Your client can be copied, patched, or shared. The decision to grant access does not have to be. Konvoa checks the account, device, license, and release against current server policy.

Create a free account Read the protocol

Start free. Signed requests, device binding, revocation, and session rotation are included.

Every protected request

A decision made from current state.

How the boundary works

AccountActive identityCredentials and access state

DeviceBound hardwareHWID policy is on by default

LicenseCurrent entitlementScope and expiration checked

ReleaseAllowed versionMinimum version can be enforced

Signed answerAccess allowedRevocable on the next request

7 SDKs: Functional reference clients
Ed25519: Client proof and signed responses
HWID default: Device sharing control from day one
Your host: Public HTTP or HTTPS file delivery

Built around the application

Change what access means after the build ships.

Operate policy, customers, collaborators, sessions, and releases from one server-side source of truth.

Access controls

Change policy without rebuilding the app.

Pause sign-ins instantly or tune hardware, network, and release rules for each application. Hash mismatch reporting remains telemetry, not a claim of hardware attestation.

Explore access controls

Users and sessions

Manage the whole customer lifecycle.

Extend or subtract access, reset a device, choose session lifetime, end active sessions, or remove selected customers and their licenses.

Open the user model

Teams and resellers

Delegate authority without giving it away.

Invite teammates, limit them to selected applications, and give each reseller exact product permissions, balances, and reversible automation credentials.

See roles and reseller scope

Versions and files

Move every customer to the release you support.

Enforce a minimum version with or without a linked file. Stable file IDs point to public HTTP or HTTPS downloads on your infrastructure, with an optional SHA-256 pin.

Review versions and files

A protocol the client can verify

The request earns its answer.

Konvoa defines the exact bytes on both sides of the exchange. Proof is verified before policy runs, and protected data is trusted only after the signed response is checked.

Read the complete integration guide

Client proofSign the canonical request

Method, path, request ID, timestamp, nonce, body hash, and key ID.

Current policyEvaluate the whole boundary

Identity, device, entitlement, scope, version, session, and replay state.

Server proofVerify the exact response

The client checks returned bytes against its pinned Konvoa public key.

Downloadable reference clients

Checksums and setup notes

Pricing

Start with the complete authorization path.

Security controls are not held back for a higher tier. Upgrade when you need more applications, customers, licenses, subscription tiers, or file records.