I needed to license a macOS app I sell outside the App Store. I went down the rabbit hole so you don't have to. Here's the honest breakdown — what each tool is genuinely good at, and where it stops. No tool is "best"; they're good at different things.
The two questions that decide everything
Before the tools, answer these:
- Do you need real offline verification? (Desktop apps usually do — see firewalls, planes, air-gapped machines.) This eliminates the "license key is just a string you check over HTTP" options for serious use.
- Do you want payments handled too, or do you already have Stripe? Some of these are licensing-only; some are merchant-of-record that also do keys.
The licensing-first tools
Keygen — the one most people name first. Language-agnostic API, deep policy engine, open-source, self-hostable. Genuinely powerful. The cost is that it's primitives: you bring your own payments, wire the webhooks, and write the client code. Pick it when you want maximum control and don't mind assembling the flow.
Cryptolens — classic license-key system with offline verification via signed responses. Strong .NET heritage. Solid if you're on Windows/.NET and want the traditional key + activation-count model.
LicenseSpring — enterprise-leaning. Floating licenses, air-gapped activation, node-locking. Overkill for a solo indie app, right at home if you're selling into companies with offline/dark-site requirements.
The payments-first tools (keys as a feature)
Lemon Squeezy / Polar — merchant of record, so they handle sales tax for you, with a license-key API bolted on (activate / validate / deactivate). Great for getting paid fast across borders. The licensing side is basic — keys are essentially strings with an activation limit; offline verification isn't really their thing.
Gumroad — the simplest possible "sell a thing, get a license key, verify over one endpoint." Fine for a cheap utility where piracy isn't worth fighting. Not infrastructure.
StoreKit — only relevant if you ship through the Mac App Store and want Apple to manage purchases/subscriptions. If you're outside the store, it doesn't apply.
Where Keylight fits
Full disclosure: I now build Keylight, so weigh this accordingly — I'm telling you the seam it's designed for, not that it wins every row.
The gap I kept hitting was the middle: Keygen gives you primitives but makes payments and client code your problem; Lemon Squeezy gives you payments but the licensing is thin. Keylight is the opinionated middle — finished SDKs (Swift, Rust, JS, C#, C++) with offline Ed25519 leases and Stripe wired in, so a payment mints a license with no webhook code and the SDK verifies offline with a checkOnLaunch() call. The tradeoff is the flip side of opinionated: it's hosted (no self-host like Keygen CE), and it's SDK-first rather than a bring-any-language REST API.
How I'd actually choose
- Want primitives + max control, any language, maybe self-host? Keygen.
- Selling into enterprises with air-gapped/floating needs? LicenseSpring.
- Windows/.NET, classic key model? Cryptolens.
- Just want to get paid across borders, licensing is secondary? Lemon Squeezy or Polar.
- Cheap utility, piracy not worth fighting? Gumroad.
- Shipping through the Mac App Store? StoreKit.
- Swift/Rust/JS/C#/C++ app, want offline licensing + Stripe done for you? Keylight.
The meta-point: match the tool to whether your bottleneck is control, payments, or time. For most indie desktop devs shipping outside the store, the bottleneck is time — you want offline licensing and payments to just work so you can get back to the app.
I went deeper on the desktop-specific tradeoffs in this ranked breakdown if you want the long version.