TPM Licensing

Configure TPM-backed licenses that enroll device keys and sign LicenseSpring requests.

In the LicenseSpring platform, you can generate and customize licenses that require a TPM (Trusted Platform Module). A TPM-required license can only be activated and used on a device with a hardware-protected key store. Every subsequent request must be signed by that device's key.

TPM licensing is an add-on feature in LicenseSpring. Contact sales to enable it on your account.

Unlike Hardware Key Licensing, TPM licensing needs no external dongle and no provisioning step. The key is created inside the hardware the end user already has:

Platform	Key store
Windows	TPM 2.0, via the Platform Crypto Provider (per-user key, no elevation required)
Linux	TPM 2.0, via /dev/tpmrm0
macOS / iOS	Secure Enclave

The key is a P-256 (ECDSA) key pair generated inside the security module that never leaves it. LicenseSpring only ever receives the public half and uses it to verify every request signature from that device.

To start using TPM licensing, you need to:

1

Create TPM-required licenses

• Issue licenses from LicenseSpring with the desired entitlements (max activations, features, validity period, etc.)
• Ensure Require TPM is ticked

2

Enable TPM licensing in your application

Turn on TPM licensing in the SDK configuration and ship the hardware ID generator library alongside your application.

Create TPM-required licenses

Require TPM can be set in three places in the vendor platform:

• License Policy (Products → your product → License Policies) - every license issued from that policy inherits the setting
• Create Order - in the License usage section of the product configuration step
• Edit License - on an existing license

Click Next and Create Order.

The setting can be changed on an already-issued license. Turning Require TPM on for an activated license means existing devices have no enrolled key. They must reactivate before checking in again.

Do not enable Require TPM and Require Hardware Key on the same license. Both are checked at activation, so the end user needs a TPM and a plugged-in hardware key. After activation, only the TPM signature is verified - the hardware key is no longer enforced. Pick one.

You can also read, filter and set the flag through the Management API:

• is_tpm_auth on License and License Policy (readable, patchable, and filterable with ?is_tpm_auth=true)
• tpm_public_key on Device - the enrolled public key, empty when the device has not enrolled one
• is_tpm_auth is included in the license CSV export

Enable TPM licensing in your application

TPM licensing is currently supported in the C++ SDK. It is disabled by default and has to be enabled explicitly in the configuration:

auto options = LicenseSpring::ExtendedOptions();
options.enableTpmLicensing( true );

auto config = LicenseSpring::Configuration::Create(
    "your_api_key", "your_shared_key", "your_product_code", "1.0.0",
    options );

Requirements:

• LicenseSpring C++ SDK - version 8.5.0 or later
• LicenseSpring Hardware ID Generator - version 1.6.0 or later, deployed next to your application binary (hardware_id_generator.dll / libhardware_id_generator.so / libhardware_id_generator.dylib). The SDK loads it at runtime to communicate with the TPM. Older versions do not export the key store functions, and the SDK raises a TpmException that tells you to upgrade.

On macOS and iOS, persisting a Secure Enclave key requires the host application process to be code-signed with a keychain-access-groups entitlement backed by an embedded provisioning profile. Applications that are not signed and provisioned this way cannot use TPM licensing on Apple platforms.

How it works

Enrollment happens at activation

Activation is the only point at which a TPM key is enrolled. When TPM licensing is enabled, the SDK asks the hardware ID generator for the device's public key (creating the key pair on first use) and sends it in the activation request as tpm_enrollment.signing_public_key, together with a licensespring-tpm-signature header proving the device holds the matching private key.

• If the license requires TPM and the request contains no tpm_enrollment, activation is rejected.
• If the request contains tpm_enrollment but the license does not require TPM, activation is rejected.
• The enrolled key replaces whatever was stored for that device on every activation. Reactivating on the same device after a TPM reset or OS reinstall simply enrolls the new key.

Every request afterwards is signed

Once enrolled, the SDK signs every request to LicenseSpring with the device's TPM key and sends the signature in a licensespring-tpm-signature header (algorithm="ES256"). The platform verifies it against the key enrolled for that license and device. This covers:

• License and bundle checks
• Consumption and feature consumption
• Floating license and floating feature register / release / borrow
• Device variables (send and get)
• Deactivation

A request that arrives without a valid signature is rejected, so a copied license file alone is not enough to keep a license alive on a different machine.

Offline activation

Offline activation is supported. Because an offline request file carries no HTTP headers, the same two values are written into the request file itself:

• tpm_enrollment.signing_public_key - the device's public key
• licensespring-tpm-signature - the signature over the request's signature field

Offline deactivation works the same way. No extra steps are required from the end user — the SDK writes these fields into the .req file automatically when TPM licensing is enabled.

Air-gapped licenses do not support TPM. Air-gapped activation uses its own confirmation-code exchange in the vendor platform and never carries a TPM enrollment or signature, so a license cannot be both air-gapped and TPM-required. Use regular offline activation, described above, if you need TPM enforcement without a network connection on the end user's machine.

Bundles

For bundle activations, sublicenses do not have to agree on TPM. Enrollment is applied to licenses that require TPM and skipped for those that do not. A mixed bundle remains activatable.

Checking enrollment in the platform

• The Licenses list has an optional Is TPM column showing which licenses require TPM.
• On a TPM-required license, the Devices tab shows a TPM enrolled column, ticked for every device that has a key enrolled.

Error reference

Error code	Meaning
tpm_enrollment_required	The license requires TPM but the activation request contained no tpm_enrollment.
tpm_not_enabled	The request contained tpm_enrollment but the license does not require TPM.
tpm_signature_required	The licensespring-tpm-signature header is missing on a TPM-required license.
tpm_signature_mismatch	The signature could not be verified against the enrolled public key.
tpm_invalid_public_key	The enrolled signing_public_key is not a valid P-256 public key.

In the C++ SDK, all of these surface as a TpmException. A device with no usable TPM or Secure Enclave - or a process not entitled to use it - raises a TpmException with error code eTpmKeyStoreUnavailable before any request is sent.