Platform

The complete control plane for licensed software.

Two planes: a control plane that owns every decision, and a runtime gateway that enforces them under signature, every five seconds, for every session. What follows is what each part does today.

Request access Documentation

01Runtime authority

Every session is a decision the server keeps making.

Obsidian keeps software access under continuous server authority, from license issuance and device binding to entitlements, sessions, delivery and revocation.

Signed answers: Cryptographically signed authorization responses, verified under a key you pin.
Heartbeat: Every heartbeat re-evaluates the whole policy, not just the token.
Rotation: Session tokens rotate every heartbeat; a stolen old token is dead on arrival.
Replay: Nonce and clock binding on every request; replays are refused before they touch the database.
Devices: Concurrency-safe first-device binding.
Revocation: Revocation reaches running sessions: refused at the next heartbeat, and pushed to connected clients.
Reasons: Denials can carry your reason, signed, so the client can show it.
Keys: Signing keys rotate with zero client downtime.
Outage: Fails closed: an outage denies, it never grants.

Fingerprints are supplied by the client and are spoofable by design; this is server authority, not DRM.

02Licensing and entitlements

Products carry terms. Everything else layers on top.

Entitlements resolve through six layers with one implementation, and every value says where it came from.

Time is an account

Expiration, lifetime access, stacking, freeze and resume. Every change to a license's time is a recorded, reproducible entry.

Floating seats

Floating licensing with a seat budget that holds under concurrency.

Bulk issuance

Bulk issuance in one transaction; keys shown again only as an audited reveal.

Availability

Maintenance drains instead of ejecting; version floors are enforced numerically.

Release channels

Release channels per license, reported in the runtime answer.

Remote configuration

Typed remote configuration in the signed answer, with server-only values that never leave the control plane.

03Resellers

A reseller network without a seat tax.

A separate population with its own console and credentials, bounded by policy that can only narrow.

Policy: Product-specific grants, duration and device ceilings, and per-reseller capabilities, all re-checked on every issuance.
Ledger: Reseller credits are backed by an append-only ledger; concurrent issuance cannot overdraft.
Sub-resellers: Sub-resellers inherit only what their parent holds, and fall with it.
Pools: Periodic allowance pools with unclaimed keys revoked at close.
API: Reseller API access, confined to the reseller's own licenses.

The reseller system

04Customer identity

One customer. Every way they prove access.

License key, password, magic link, Discord and passkey sign-in, per application and under your policy.

Four populations

Operators, members, resellers and customers are separate security populations, with separate cookies, separate sessions and separate tables.

Hosted login

Hosted login: Authorization Code + PKCE, with license gating and refresh-token reuse detection.

A hosted sign-in can bridge into a runtime session on one device with a single-use, two-minute token, so a desktop application never handles a password.

05Commerce and fulfilment

From payment to permission.

From payment to permission: normalised orders, idempotent fulfilment, every step recorded and replayable.

Order paid
Customer
License
Entitlements
Download
Discord
Webhook

Discord roles that follow licenses and entitlements, granted and removed by the platform, never by hand.

Bundles, invites and coupons that resolve to the same license rows as everything else.

Referral programs credit time or cash through the same ledgers; earned rewards accrue from recorded activity. Campaigns and transactional mail use your templates under your brand.

Providers: SellAuth and a signed custom contract.

06Software delivery

Ship privately. Authorize every download.

Private object storage; five-minute authorized downloads; every grant recorded.

Gate: Downloads can require a current entitlement.
Channels: Release channels per license, reported in the runtime answer.
Provenance: SHA-256 and approved provenance on every file; per-holder watermarked builds, sealed and revocable.

Watermarking identifies a leaked artifact; it is not anti-tamper.

07Migration

Switch the infrastructure, not the business.

Discover, map, dry-run, import, verify. From an Obsidian archive, a KeyAuth export, CSV or JSON.

Source
Discover
Map
Dry run
Import
Verify

KeyAuth is the only named third-party format; other systems go through CSV or JSON.

08White label

Your customers shouldn't need to know we're here.

Your portal, store and hosted login on your own hostname, verified by DNS, with the certificate issued at the edge.

Your brand

Brand name, logo, accent and support identity on every holder-facing surface.

No custom typography and no custom scripts on sign-in surfaces, by design.

Your hostname

portal.yourdomain, store.yourdomain, login.yourdomain, verified by a DNS TXT record, certificate issued at the edge, and the holder-facing surfaces only. The workspace, the reseller console and the operator console never appear on a custom host.

09Operations

Counts, not estimates. Flags, not verdicts.

The analytics reconcile against the rows they count, and the review queue is a list of things a person should look at, never a score.

Analytics: Analytics that reconcile to the rows, with denominators. Never an estimate.
Review: Flags for humans, from counting rules. No risk scores, no automatic bans.
Tracing: OpenTelemetry across both planes, with secrets kept out of spans.
Webhooks: Webhooks that are signed, retried, inspectable and replayable.
Feed: Event catch-up from an exact, gap-free sequence. No webhook required.