Licensing and Credential Security
Licensing and Credential Security
Product credentials, customer entitlements, device access, offline grace, and the differences between script and native integrations.
Updated 2026-10-05
SoundSync
Choose the integration depth
The packages share the licensing service but have different installation and client-security boundaries.
| Integration | Implementation | Security boundary |
|---|---|---|
| HISEScript | Script/WebView package and generated product configuration | Easier integration; distributed script logic is easier to inspect or modify |
| HISE C++ | Native-authoritative package requiring the HISE source patch/build workflow | Stronger native enforcement; still not a promise that piracy is impossible |
| JUCE | Complete source package with module, native core, components, examples, and documentation | Native client integration; validate the final product build and supported platforms |
| Custom HTTP client | Activation, validation, deactivation, claim, and related public API routes | The developer owns client storage, scheduling, UI, and product gating |
Activation is different from validation
Activation registers permitted use on a device. Validation checks whether the product can still be used under the current entitlement and license state. Deactivation releases a device slot where supported. Credential checks alone do not establish that a customer owns a product.
Package-specific access policy
JUCE 0.7.0 requires online renewal at startup. Valid saved credentials are reused without repeated sign-in, but offline audio access is unavailable in this release. HISEScript offline grace is a different package policy.
HISEScript grace requires prior valid, unexpired access. Confirmed invalid or revoked access cannot be treated as a network failure. Native HISE requires the compiled authority to be present and tested.
Credentials shipped in software are extractable
Product-scoped credentials reduce scope but are not an unextractable secret. Rotation, revocation, server entitlement checks, and device policy remain necessary. Keep private account credentials and full serials out of public examples, logs, and screenshots.
Release testing belongs to the final build
Test customer login, serial claims, startup validation, device limits, deactivation, offline expiry, subscription state, refunds, and package regeneration in the exported product. A package download or screenshot does not prove every runtime state works.
SoundSync does not claim a security certification, a service-level uptime commitment, or an invulnerable client. The integration guides identify the relevant package and API behavior.
SoundSync
Implement and troubleshoot
Use the guide for the package you actually ship.