We are an IT startup which provides some clients with a Software Development Kit, which may be used by the client within a specific environment, according to some terms and legal agreement. Especially, the client could call SDK's public services and methods from its own source code.
For example, the agreements may require that the client may use the SDK only in ONE environment (in an application for example).
Thereupon, we would like to monitor the SDK to ensure that the client respects this constraint, and if he use the SDK in an environment he didn't buy the SDK for, we want to be able to block the access to the SDK, so he couldn't use it.
I do know that several companies implement such features for the frameworks and SDK they provide, but I couldn't find anything on the web on how to set up such a mechanism ...
We would like to use some standard solution, even it is a paid one, rather than building something from scratch ...
Thanx very much for anyone who could enlightens us !!!
Our SDK does not provide web services, it provides only local methods which client may call after installing the SDK.
Actually there is only one http-request-based method in the SDK. It's the entry point of the SDK, a method which is called
setUp() which takes essentially two parameters : client's username and password.
So foremost the client has to call this method, which check out his credentials through http request to our server. If the authentication succeed, then the client may use the SDK local methods, otherwise he cannot.
I just discovered the concept of API key, at first I thought it would be a potential solution for this problem, but it appears that it doesn't suit the context of the issue I'm trying to solve, thanx to @Matthew.
Now I'm wondering if a license enforcement would be a suitable solution ?? Actually I am thinking about the way Aspose team handles the licenses they give to their clients. Following to this link, they seems to manage DRM rather tightly ...
And one last thing, what is the difference between a license and a product key ? Knowing the advantages and drawbacks of each of these solutions might help me a lot for choosing the right security system for my API.