Devices & Seats

WPLM binds licenses to devices (machines) by a hardware fingerprint, and accounts for seats (allowed activations) per license. This is the heart of the node-lock / floating model.

Fingerprints

Clients compute a stable per-device fingerprint (for example a SHA-256 of a machine GUID) and send it on activation. Server-side, WPLM hashes it again with HMAC-SHA256 using a site secret, so stored fingerprints are pseudonymous — they can’t be reversed to identify hardware.

Each device row records: fingerprint, friendly name, hostname, IP (packed v4/v6), platform, app version, first/last seen, and status.

Activation & seats

1. The client calls POST /wplm/v1/activate with the key + fingerprint.
2. WPLM validates the license, then:
   • If a device row already exists and is active → returns it (idempotent — no new seat consumed).
   • Else, if seats are available → creates the device, increments the activation count, and sets relative expiry on first activation.
   • Else → fails with machine_limit_exceeded.

Deactivation (POST /wplm/v1/deactivate) frees the seat. Clients should deactivate on app exit; the heartbeat monitor reclaims crashed seats automatically (see Monitoring).

$machine = wplm_activate_device( $key, $fingerprint, array( 'name' => 'Office PC' ) );
wplm_deactivate_device( $key, $fingerprint );
$devices = wplm_get_devices( $key );

Overage strategy

Per license (overridable per product / license type), the overage strategy controls how strictly the seat limit is enforced:

Strategy	Effect
deny	Hard limit — activations may never exceed max.
allow_1_25x	Permit up to 1.25× seats temporarily.
allow_2x	Permit up to 2× seats (e.g. cloud rolling deployments).

Floating / concurrent licenses

When a license is marked floating, an activation grants a lease rather than a permanent node-lock: lease_expires_at = now + lease duration. The client renews the lease via heartbeat; expired leases are reclaimed by cron, freeing the seat for another user. This enables “borrow a seat from the pool” concurrent licensing.

Component sub-fingerprints

A device can track sub-fingerprints for individual hardware components (CPU, motherboard, disk, GPU…) under one machine, for stricter binding.

Browsing & revoking devices

License Manager → Devices is a global browser — filter by license/status and revoke a single device (POST /wplm/v1/machines/{id}/revoke) without affecting the rest of the license.