Secure licensing infrastructure built for production scale

Licensing had become part of the product

Independent game studios selling outside centralised platforms still need to control who can access their products, which versions a customer may use and how protected assets behave after distribution.

For Keydros, that made licensing more than an administrative feature. A slow check would delay legitimate customers. An unavailable service could block software that had already been purchased. A predictable request could be replayed by an unauthorised installation.

The central engineering question was simple to state: how do you enforce licensing controls without allowing the licensing system itself to become a single point of failure?

• Authenticate customers and installations
• Control access to permitted product versions
• Detect expired or replayed requests
• Support controlled offline operation
• Remain responsive during traffic spikes

Two trust stages, one clear decision

We separated authentication into two stages. The first verifies that the protected product is operating inside its expected script environment. The second sends a signed request to the distributed edge infrastructure, which validates the licence, permitted version and freshness of the request.

HMAC-SHA256 signatures prove that a request has not been changed in transit. Time-bound request data limits how long a valid exchange can be reused. No individual check is treated as sufficient on its own.

A repeatable protection workflow for Kivo Studios

Kivo Studios needed to protect distributable FiveM map assets without creating a complicated publishing process. We built Blitz around the workflow the studio already used.

The publisher uploads a .yty file. Blitz generates a unique seed, a protected asset and its runtime script. The distributed asset stays unusable until the customer identity and permitted product version are validated through the shared Keydros infrastructure.

This gave Kivo a familiar way to publish while retaining control after delivery. Only an authorised installation receives what it needs to reconstruct the asset at runtime.

Proven under production traffic

During a measured seven-day period, the infrastructure processed more than 739,000 requests. That included over 60,000 executions of the edge application logic.

P90 Worker CPU time remained at 31 milliseconds throughout the measured period. At the observed traffic level, the system was operating at an equivalent rate of approximately 3.1 million requests per month.

What we delivered

Keydros established a reusable licensing foundation for independently distributed digital products. Kivo extended it into an automated asset protection workflow without introducing a second authentication system.

• Distributed licence validation
• HMAC-SHA256 request authentication
• Runtime and version verification
• Controlled offline operation
• Automated asset protection
• Edge-based production execution