Licensing

Dispatch is licensed per subscription: 14-day trials, 3 machines per key, checked at every launch. A 14-day trial key is self-serve from the activation screen the app shows you.

This page describes how the gate behaves.

The shape of it

  Dispatch (installed)                    licence server
  ─────────────────────                   ──────────────
  launch
    └─ POST /v1/validate  ──────────────▶ key active? machine known?
         { key, fingerprint }             seats free?
                                            └─ Ed25519-signed token ─┐
    ◀───────────────────────────────────────────────────────────────┘
    verify the signature against the
    public key baked into the build
    └─ opens the dashboard

Every launch asks. The security of the whole thing rests on one property: the server signs, the app only verifies.

Pointing an installed copy at a different server, by DNS, proxy or hosts file, gets it tokens that fail the signature check. The API base is not a trusted value and does not need to be.

Keys

Format: DSP-XXXXX-XXXXX-XXXXX-XXXXX.

One key covers 3 machines, entered once per machine in the activation window.

Seats

Seats bind to a hardware id: Windows MachineGuid, and the equivalent on macOS and Linux.

Not MAC addresses. Hyper-V, WSL, Docker and every USB dock add and remove adapters, so a fingerprint built on those would spend a seat every time a VPN came up.

A fourth machine gets a refusal that includes the list of machines using the seats, and the activation screen turns it into a Release button, so a new laptop is something you sort out yourself.

Trials

Self-serve, email-gated, 14 days, issued once per address and once per machine.

The key is emailed and returned to the app, so a trial starts on the activation screen rather than in a webmail tab.

Someone who trials and then subscribes keeps the same key: the trial is upgraded rather than replaced, so the key already typed into the app goes on working.

The grace window

Dispatch checks the licence at launch, and that answer is good for 72 hours. A machine that spends a day or two away from a network keeps opening on the last answer it got.

An answer that says no (revoked, expired, cancelled) takes effect immediately, and no cached token overrides it.

What this stops, and what it doesn’t

It stops: sharing one key across a team, using it after cancelling, using it after a refund, running past a trial, and casual “I’ll just download it” copying.

It does not stop a determined person with a disassembler. Dispatch is compiled, but the check can be patched out by someone who wants to badly enough. What is in place raises that cost:

Ed25519-signed entitlements

Tokens cannot be forged or edited, and one lifted from another machine fails the fingerprint check. This is what makes key sharing pointless rather than merely against the rules.

A device keypair

Each machine mints an Ed25519 key on activation, keeps the private half sealed with Windows DPAPI, and signs every check with it. The server binds the public half to the seat the first time it sees it and never rebinds it, so a stored token and a fingerprint lifted off someone’s disk stop being enough.

Compiled, and not a readable container

There is no archive to unpack, no licence file to edit and no NODE_OPTIONS to inject through. Release builds are linked with fat LTO and stripped of symbols, so most of what a patch would go looking for has no name left.

The check at every call site

It sits at the top of every command that spawns, writes to or drives something, so there is no single boolean to flip. Nothing else starts ahead of it either: the plugin host, the MCP bridge, the Studio link and the hook endpoint all open from one function that only runs on a yes.

Dispatch is its own MCP server, the same executable launched with --mcp-stdio, so there is no second script or side runtime to hold a door open for.