FiveM release protection and licensing
PulseLicense
Protect Lua releases, connect store orders, issue licenses, and monitor active servers.
Open PulseLicenseGetting started
Developers control products and licenses. Buyers continue using the developer's existing store.
Create a developer product
Sign in to the developer workspace, create the product, and define its activation and release policy.
Protect a build
Upload fxmanifest.lua and the main server Lua file from the browser or use the CLI build workflow.
Publish through your store
Download the secured release and publish it through Tebex or another storefront you control.
Connect completed orders
Create a scoped store token and send each completed order to POST /v1/store/orders.
Deliver the license
Your store gives the buyer the secured files and key. The buyer puts the key in server.cfg and the loader activates it.
Developer workspace
The web application keeps build, license, integration, and operational work together.
Overview
Review license trends, product health, build success, workers, Redis, delivery history, stale servers, and recent activity.
Products and builds
Manage products, policies, uploads, protected builds, release channels, downloads, and rollbacks.
Licenses and servers
Search keys, monitor activations and heartbeats, revoke access, and investigate suspicious IP changes.
Integrations and tokens
Create store-order tokens, CLI tokens, and API tokens with the narrowest required scopes.
Store order API
The completed-order endpoint is idempotent and does not process payments.
Authentication
Send Authorization: Bearer <store-token> using a token with licenses:write scope.
Required identifiers
Provide store, orderId, productId, and policyId. Buyer and package metadata can be included when available.
Retries
A repeated store and order ID returns the original license. Concurrent duplicate processing returns a retryable conflict.
Delivery ownership
PulseLicense returns the key to the store integration. It does not email buyers or replace the developer's storefront.
CLI workflow
The Node.js 22 CLI protects local resources and manages releases without a browser upload.
Install
From the repository, run npm install, npm run cli:build, and npm install --global ./cli. Use pulselicense --help to confirm the command is available.
Authenticate
Run pulselicense login --api-url <api-url>. Approve only a device code that you started from your own terminal.
Link the resource
In the FiveM resource directory, run pulselicense init and pulselicense link. Use --product when linking to an existing product.
Build and release
Run pulselicense build, inspect a build with pulselicense logs <build-id>, then publish with pulselicense release <version> --channel latest.
Rollback
Use pulselicense rollback <product-id> <build-id> --channel latest to move a channel back to a known-good build.
License commands
Use pulselicense license list, inspect <license-id>, and revoke <license-id> for terminal-based license management.
Local credentials
Authentication is stored in ~/.pulselicense/config.json. Project settings are stored in pulselicense.config.json beside the resource.
Token lifetime
CLI login tokens expire after 90 days and can be revoked from Developer Settings.
API reference
The unified API serves developer, store, activation, heartbeat, CLI, and internal traffic on port 8080.
Products and policies
GET or POST /v1/products and GET or POST /v1/products/:id/policies.
Builds and channels
POST /v1/products/:id/builds, GET /v1/builds/:id, and PATCH /v1/products/:id/channels/:channel.
Licenses
GET or POST /v1/licenses, GET /v1/licenses/:id, and POST /v1/licenses/:id/revoke.
Runtime validation
POST /v1/activate creates a server grant and POST /v1/heartbeat refreshes an active grant.
Developer authentication
Send Authorization: Bearer <token>. Tokens are scoped; a store integration should receive only licenses:write.
Internal routes
Routes under /internal require x-internal-secret and must never be exposed to a storefront or protected Lua resource.
Deployment
Run the web app, unified API, and build worker as separate processes with durable state.
Provision dependencies
Provide MySQL, Redis, and a persistent artifact volume shared by the API and build worker.
Create secrets
Generate independent AUTH_SECRET, PULSELICENSE_MASTER_KEY, PULSELICENSE_ARTIFACT_KEK, and INTERNAL_API_SECRET values.
Prepare the database
Install dependencies, run npm run db:migrate, and build the workspace before starting the new release.
Start production
Run docker compose --env-file .env -f infra/compose/docker-compose.prod.yml up -d --build.
Smoke test
Verify Discord sign-in, token creation and revocation, a disposable protected build, and an idempotent duplicate store order.
Health checks
Check the web root and GET /health on the unified API.
Observability
The optional local stack uses Prometheus, Loki, Promtail, and Grafana.
Backups
Set BACKUP_PASSPHRASE and run npm run backup to capture the database, encrypted keys, and encrypted local artifacts.
Managed services
Set DATABASE_URL when using an operator-managed MySQL service; otherwise the production compose file provides MySQL.
Security and operations
Protect signing material, artifacts, tokens, and backup keys as production secrets.
Build pipeline
The worker validates, obfuscates, encrypts, signs, and watermarks protected releases.
Runtime access
The FiveM loader activates the key, verifies grants, and reports heartbeats within configured grace behavior.
Backups
Set a backup passphrase and back up the database, keys, and encrypted artifacts on a tested schedule.
Observability
Use the health and metrics endpoints with the included Prometheus, Loki, and Grafana stack when self-hosting.