Migrate from Keygen to Licentric in under an hour

• You want license keys + Stripe billing in one product with zero webhook glue code.
• You ship AI agents and need per-agent token budgets, identity, or MCP auth.
• You want a full admin dashboard on every tier including Free.
• You're starting in 2026+ and want native container-aware fingerprinting for Docker/K8s.
• You want a generous free tier (100 active licenses, full API, no credit card).
• You want a built-in end-user self-service portal on every tier.
• You want offline files signed with Ed25519 (FIPS 186-5, deterministic, 64-byte signatures).
• You want compliance scaffolding for the EU AI Act (phased enforcement starting August 2026).

• License keys keep their identifiers. Licentric stores both the SHA-256 hash and the raw key (encrypted at rest), so existing keys your customers already hold continue to validate.
• Machine fingerprints re-validate on first contact. Activated machines from Keygen re-establish their fingerprint binding the next time your app calls validate() against Licentric.
• Policy → license relationship preserved. The Keygen policy name maps to a Licentric policy with matching maxMachines / expiry / metadata fields.
• Customer email + status preserved. status=active stays active; suspended stays suspended; revoked remains revoked (terminal-state guarded).
• Audit history export — you can hold Keygen's audit log as a CSV alongside Licentric's new append-only audit trail. We do not import historical Keygen audit rows into Licentric (separate retention contracts); export them once at cutover and archive.

Same operation, different shape. The Licentric snippets below were extracted verbatim from the published SDK source (sdks/python/licentric/client.py and sdks/typescript/src/client.ts); the Keygen snippets reflect the public Keygen REST API convention (application/vnd.api+json, /actions/validate-key).

Python

# BEFORE — Keygen REST API (illustrative; see keygen.sh/docs/api)
import requests
resp = requests.post(
    f"https://api.keygen.sh/v1/accounts/{KEYGEN_ACCOUNT_ID}/licenses/actions/validate-key",
    headers={
        "Content-Type": "application/vnd.api+json",
        "Accept": "application/vnd.api+json",
    },
    json={"meta": {"key": license_key}},
)
data = resp.json()
is_valid = data.get("meta", {}).get("valid", False)

# AFTER — Licentric Python SDK (sdks/python/licentric, verified against client.py)
from licentric import Licentric

client = Licentric(api_key="lk_live_your_key_here")
result = client.validate(
    key=license_key,
    fingerprint=client.fingerprint(),
)
is_valid = result.valid  # ValidationResult with .code, .license, .machine

TypeScript

// BEFORE — Keygen REST API (illustrative; see keygen.sh/docs/api)
const resp = await fetch(
  `https://api.keygen.sh/v1/accounts/${KEYGEN_ACCOUNT_ID}/licenses/actions/validate-key`,
  {
    method: "POST",
    headers: {
      "Content-Type": "application/vnd.api+json",
      "Accept": "application/vnd.api+json",
    },
    body: JSON.stringify({ meta: { key: licenseKey } }),
  },
);
const data = await resp.json();
const isValid = data?.meta?.valid === true;

// AFTER — Licentric TypeScript SDK (sdks/typescript, verified against client.ts)
import { Licentric, fingerprint } from "@licentric/sdk";

const client = new Licentric({ apiKey: "lk_live_your_key_here" });
const result = await client.validate({
  key: licenseKey,
  fingerprint: await fingerprint(),
});
const isValid = result.valid;

During Phase 3 your application validates against BOTH platforms for 1–2 weeks. Licentric is queried first; on any failure (network, not-found, or invalid), the call falls through to your existing Keygen validation. Customers see zero downtime; you see real production traffic exercising Licentric before cutover.

The dual-write pattern is the same code path that the in-product migration guide ships — a single source of truth so this page never drifts from the canonical sample.

The migration is reversible. Licentric supports full data export via the dashboard and the REST API. Both platforms accept standard CSV imports, so a return migration is symmetric to the inbound one. If Licentric does not work out:

1. Export licenses from Licentric (Dashboard → Settings → Export Data, or GET /api/v1/licenses?limit=200 cursor-paginated).
2. Re-import the CSV into Keygen using their dashboard's standard license import.
3. During the 30-day overlap window you left in place at Phase 4, your app's dual-write fallback already validates against Keygen — flip the order (Keygen first, Licentric fallback) for a clean reversal.
4. Cancel your Licentric subscription via the customer portal. No long-term contract; month-to-month.