Skip to content
Lizen

Key formats

Lizen uses two distinct types of keys. Understanding the difference is important for correct integration.

License keys

License keys are what your customers enter to activate your app.

Default format:

MYAPP-ABCD-EFGH-IJKL
  • 4-segment, uppercase alphanumeric
  • The prefix (MYAPP) is configurable per product
  • Each segment is 4 characters

Storage: License keys are stored in plaintext (required for validation lookup) and as a SHA-256 hash. The plaintext is never logged.

Secret scanning: License key format is not a standard secret format — your customers enter them manually. Treat them as sensitive but not equivalent to API credentials.

API keys

API keys are your credentials to call the Lizen API. Never ship them inside your app.

Format:

lz_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p
  • lz_ prefix followed by 32 random alphanumeric characters
  • Total length: 35+ characters

Storage: Only the SHA-256 hash is stored. The raw value is shown once at creation and then discarded. If lost, rotate — not recover.

Secret scanning: The lz_ prefix is recognised by GitHub’s secret scanning, GitLeaks, and similar tools. If you accidentally commit an API key, rotate it immediately from Settings → API Keys.

Offline license files

Offline activation produces RS256-signed JWTs:

eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL2FwaS5saXplbi5kZXYi...

These are base64url-encoded and can be stored as a file or string. They contain the device fingerprint, plan, and expiry — all verifiable without calling the API. See Offline activation.