How to Sell Software License Keys Online with Auto Delivery

To sell software license keys online, you generate or import a set of keys, list your software on a storefront with a checkout, and set up automated license key delivery so each buyer gets a unique key as soon as their payment is confirmed. Your software then checks that key, either offline against a format or signature or online against a licensing server, before it unlocks. The rest of the work is managing stock, offering different license durations, and stopping keys from being leaked or resold.

This guide covers the decisions behind each of those steps: how keys are formatted, whether to pre-generate keys or create them at purchase, how to structure variants, and what to do when a buyer gets a refund or a key turns up on a forum.

Key takeaways

• Every order should get its own unique key, delivered automatically once payment is confirmed, never the same key shared across buyers.
• Pre-generated key stock is simple and works with any software. Licenses generated at purchase through a licensing system like KeyAuth give you more control, including durations and server-side checks.
• Use product variants for license lengths (day, week, month, lifetime) so buyers pick a duration and get the matching key.
• Plan for refunds and leaks: you need a way to disable a key, and server-side validation with hardware (HWID) locking makes keys much harder to share.
• Keep stock topped up and watch counts so a popular product doesn't sell out without you noticing.

How software license keys work

A license key is a string that proves a buyer is allowed to use your software. Software checks it in one of two broad ways:

• Offline validation: the software checks the key's structure, a checksum, or a cryptographic signature without contacting a server. It's simple and works without internet access, but once a key is valid it stays valid, and you can't revoke it remotely.
• Online validation: the software sends the key (often with a hardware identifier) to a licensing server that checks whether it exists, hasn't expired, and isn't banned. This lets you revoke keys, enforce expiry, and limit how many devices use one key.

For most paid tools sold online today, especially anything prone to sharing, online validation is the safer default.

Common key formats

There's no single standard, but a few formats are common:

• Grouped alphanumeric: ABCD-EFGH-IJKL-MNOP. Easy to read and type. Leave out ambiguous characters like 0/O and 1/I/L to cut down on support tickets.
• Prefixed keys: PRO-7F3K-92QX-LM4D. A prefix shows the tier or product at a glance, which helps support staff.
• Long random tokens: 32 or more random characters. Hard to guess, which makes sense when keys are only ever copied and pasted.
• Signed keys: the key contains data (such as tier or expiry) plus a signature your software can verify offline.

Whatever format you choose, generate keys with a cryptographically secure random source. Keys built from predictable patterns or sequential numbers can be guessed.

Two ways to source keys: pre-generated stock vs. generated at purchase

Pre-generated key stock

With key stock, you create a batch of keys ahead of time, register them in your licensing system or software, and upload them to your store. When someone buys, the store takes the next unused key from stock and delivers it.

This works with almost any software, including keys from a third-party vendor you're authorized to resell. It's also easy to reason about: one line of stock is one sale.

On OpenStock, you paste keys into a product's inventory one per line, and they're delivered automatically after payment. Stock can be limited or unlimited, and you can hide stock counts from customers if you'd rather not show how many are left.

The downside is upkeep. You have to generate and upload new batches, and keep the store's stock in sync with your licensing backend.

Licenses generated at purchase with KeyAuth

KeyAuth is a licensing and authentication service that many software developers use to issue and validate keys. Instead of holding a stock of keys, your store can ask KeyAuth to create a fresh license at the moment of purchase.

On OpenStock, KeyAuth delivery uses your KeyAuth seller key to generate a license when an order completes, with the duration and license level you set on the product. It's available on the Silver plan and up. Because the license is created inside KeyAuth, it's immediately valid in your software, carries the right expiry, and can be managed (extended, banned, deleted) from your KeyAuth dashboard.

Which should you choose?

If you're shipping a new tool and haven't built licensing yet, a generated-at-purchase system saves you from reinventing validation. If you're reselling keys from a vendor or your software has its own key system, pre-generated stock is the simpler path.

One key per order

The most important rule in key delivery is that every purchased unit gets its own key. Sharing one key across buyers makes leaks untraceable and refunds impossible to enforce. Good practice:

• Take each key from stock exactly once and mark it as used when it's delivered.
• If a buyer orders several units, deliver several distinct keys.
• Record which key went to which order, email, and payment so you can trace any key back to its buyer.
• Never reuse a key from a refunded order for a new customer unless you're certain it was never activated.

That traceability matters later, when you need to revoke a key or work out where a leaked key came from.

Use variants for license durations

Many software sellers offer the same product at several lengths, such as one day, one week, one month, and lifetime. Short durations lower the barrier to trying the product, and lifetime licenses appeal to committed users.

Set these up as variants of a single product rather than separate products. That way buyers see all the options on one page and can compare prices easily. Each variant then needs its own delivery source:

• With key stock, keep a separate pool of keys for each variant, generated with the matching duration in your licensing system.
• With KeyAuth delivery, set the duration and license level for each variant so the generated license matches what the buyer picked.

Price variants so longer durations offer clear value per day without undercutting your lifetime tier. A common pattern is to make the monthly option feel like the default, the daily option feel like a trial, and lifetime feel like the best deal for regular users.

Handling refunds and chargebacks

When you refund an order, or lose a chargeback, the buyer still has the key. Plan for that before your first sale:

1. Disable the key in your licensing system. With KeyAuth or another online validation backend, ban or delete the license tied to that order. Offline-only keys can't be revoked, which is a strong argument for online validation.
2. Record the outcome against the order so you don't deliver to the same buyer again by mistake.
3. Block repeat abusers. If someone keeps buying and disputing, block their email or IP for future orders.

On OpenStock, Fraud Shield (Silver and up) supports IP and email blacklists, country blocks, and high-value order rules, with actions to block, flag for review, or silently log. If your product also comes with a Discord role, OpenStock's Discord integration can remove the role, or remove the role and kick the member, when an order is refunded or charged back. See our guide on reducing chargebacks on digital goods for a broader playbook.

Preventing key leaks and reselling

Popular software keys get shared, resold, and posted publicly. You can't stop every attempt, but you can make it unprofitable:

• HWID locking: bind each key to the first device that activates it, and require a reset (limited or manual) to move it to another device. This is the single most effective defense against key sharing.
• Server-side validation on every launch: check the key regularly, not just once, so a banned key stops working quickly.
• Expiring licenses: time-limited keys lose value fast, which makes them less attractive to resell.
• Rate-limit activations: flag keys that activate from many IPs or devices in a short window.
• Trace leaks to orders: because each key maps to one order, a leaked key tells you exactly which buyer to look at.
• Clear terms: say in your terms of service that keys are non-transferable and that sharing leads to revocation without a refund.

Running the store side

A few operational habits keep a key store running smoothly:

• Watch stock levels on pre-generated products and restock before you run out. Hidden stock counts are great for appearances, but you still need to know the real number.
• Write a precise delivery note explaining how to activate the key, where to download the software, and how to get support.
• Point buyers to their order page in your FAQ so they can find their key again without opening a ticket.
• Use webhooks to track sales in your own tools. OpenStock can post order.created, order.completed, and order.refunded events to a Discord webhook, which makes it easy to keep an eye on refunds that need keys revoked.

For the full delivery picture, including emails and order pages, read automated digital product delivery. If you're new to selling, start with the pillar guide on how to sell digital products online, and check the glossary for terms like HWID lock and serial key stock.

Getting started

To start selling keys: decide between pre-generated stock and generated-at-purchase licensing, set up variants for your durations, write a delivery note, connect your payment methods, and set fraud rules before launch. OpenStock's features page lists the key delivery, KeyAuth, and Fraud Shield options, the pricing page shows which plan includes what, and the docs walk through setup. When you're ready, you can create a store and upload your first batch of keys.

Frequently asked questions

How does automated license key delivery work?

You load keys into your store, or connect a licensing system that generates them, and link them to a product. Once a buyer's payment is confirmed, the store assigns an unused key to that order and sends it by email and on an order page. No manual step is needed, so buyers get their key within moments of paying.

Should I use pre-generated keys or generate them at purchase?

Pre-generated key stock works with any software and is simple to set up, but you have to keep it restocked and in sync with your licensing backend. Generating keys at purchase through a system like KeyAuth removes restocking and makes durations and revocation easier, but your software has to use that licensing system. Many new developers prefer generating at purchase, while resellers usually use stock.

How do I sell license keys with different durations?

Create one product with variants such as day, week, month, and lifetime, and give each variant its own delivery source. With key stock, upload a separate pool of keys for each duration. With KeyAuth delivery on OpenStock, set the duration and license level for each variant so the generated license matches the buyer's choice.

What should I do with a license key after a refund?

Disable or ban the key in your licensing system so it stops working, and note the refund on the order. This only works if your software validates keys online, which is one reason server-side validation is recommended. If the buyer abuses refunds or chargebacks, block their email or IP from future purchases.

How can I stop people from sharing or reselling my license keys?

The most effective measure is HWID locking, which binds each key to a single device, combined with server-side checks every time the software starts. Expiring licenses, activation rate limits, and terms that ban transfers add more protection. Because each order gets a unique key, any leaked key can be traced back to the original buyer.