Licence

The CLI validates your licence once, before any obfuscation work starts. If the licence is not accepted, nothing is processed and the CLI exits with code 1.

You only ever provide your customer licence key. The obfuscation config contains no licence field.

Store the key on your machine

On a workstation, store the key once in the operating system keyring:

hashguard -licence-login

The CLI asks for the key without echoing it. To pass it non-interactively, for example from a setup script:

hashguard -licence-login -licence-key "XXXX-XXXX-XXXX-XXXX"

Supported keyrings:

System	Keyring
macOS	Keychain
Windows	Credential Manager
Linux	GNOME Keyring or Secret Service, and KWallet when available

Provide the key through the environment

In CI and on headless machines, do not use the desktop keyring. Set the key in the PLR_LICENCE_KEY environment variable instead, as a secret of your CI system:

export PLR_LICENCE_KEY="XXXX-XXXX-XXXX-XXXX"
hashguard -config obfuscator-config.json

When PLR_LICENCE_KEY is set, it is used before the keyring. See Continuous integration.

Machine seats

A licence covers a number of machines, called seats.

• Before obfuscating, the CLI consumes a seat for the current machine, or reuses the one it already holds.
• The machine is identified by a hardware id computed locally from hardware and system identifiers, hashed with SHA-256 and sent as a digest. The raw identifiers never leave the machine, and the id cannot be configured.
• The activation is refreshed before the run, and the seat is released when the CLI exits.
• The check runs once per invocation. In multi-slot runs it also runs once, then every slot executes.

The obfuscator version is sent along with the check when the distribution carries one.

When the check fails

Message	Cause
OS keyring is not available. Use PLR_LICENCE_KEY for CI/headless environments.	No keyring on this machine: set PLR_LICENCE_KEY.
Licence rejected: …	The licence server did not accept the key; the message carries its verdict.