Customer portal

A page where your customers sign in with a link emailed to them. They see their licenses and the devices each one is on, and can deactivate a device, have a key emailed again, download a key file, and manage a subscription's billing.

Turn it on

In Settings > Portal, turn on Customer portal. Its address is made from your tenant's name, such as portal.keygrant.dev/northsound. Change it under Address:

• 3 to 40 lower-case letters, digits and single hyphens, starting and ending with a letter or digit.
• A few words are kept for KeyGrant, such as admin, api and support.
• It can be changed five times a day.
• An address you move from stays yours for a year (your last three). While the portal is on, it sends visitors on to the new one, so links in emails already sent keep working.
• Changing it signs out customers signed in at the portal.keygrant.dev address: they sign in again at the new one. Customers on your own domain stay signed in.

Turned off, the address shows a page saying there is no portal there, and no sign-in links are sent.

How it looks

Under Appearance on the same tab:

• Header: your logo alone, or your icon and name, at the top of every page and of the sign-in email.
• Theme: System follows each customer's light or dark setting; Light and Dark draw every page that way.
• The images and colours come from Settings > Branding. Its Accent colour fills the main buttons, such as Sign in and Manage billing.
• The browser tab shows your icon, else your logo, else KeyGrant's mark.
• The footer shows the Legal or trading name and the Support address shown to customers from Settings > Business, and Powered by KeyGrant.

Preview shows the sign-in page and the licenses page, with sample licenses of your products.

How customers sign in

There are no passwords. A customer enters the email address their license was sent to.

• If that address holds a license of yours, or bought several keys in one purchase, KeyGrant emails it a sign-in link. The page says the same either way, so it never shows who your customers are.
• The link works once, for 15 minutes. Opening it shows a Sign in button, and only pressing it signs in, so an email scanner that follows the link does not use it up.
• One address is sent at most three links in 15 minutes.
• One IP address can ask for at most 10 links in 10 minutes. Past that, the page says how many minutes to wait.
• The email comes from KeyGrant's address, with your Legal or trading name on the From line. Replies go to your Support address shown to customers, when you have set one.
• Sign-in links count toward the 120 emails an hour your account may send this way, together with keys emailed from the portal, the Device limit reached email and recover's list (see Emails a customer can set off), and may use at most 60 of them, so a flood of sign-in requests never stops the others. Past either, no link is sent, and the page says the same as ever.

What customers see

A list of every license at their email address, newest first (the newest 200 at most). Each shows the product, the license model and the key with its middle hidden. A license that stopped working says Expired or Revoked.

Opening one shows:

• The whole key, with a Copy button.
• The versions it covers, its entitlements, and its upgrade window, if it has one.
• When it expires, or for a subscription, when it is paid through.
• How many devices it is on, of its limit, and what each of its meters has left.
• Each device: its name, platform, app version and when it was last seen.

What customers can do

Deactivating, emailing and downloading are recorded in the key's History.

Keys bought for a team

A license model can sell several keys in one purchase. Each key starts with the buyer's email address. The buyer hands the keys out from the portal, under Keys you bought.

• Each purchase lists its keys, each with its key hidden, who holds it, and how many devices it is on.
• To give a key to someone, the buyer enters their email address and chooses Give. The key moves to that address, and KeyGrant emails the key to them, unless the product's License delivery tab is set to You send them.
• For a key on devices, a box, ticked unless the buyer unticks it, signs the key out of those devices.
• The new holder signs in with their own address and sees the key as theirs. They cannot give it to anyone else.
• The buyer can give a key on again, or take it back by giving it to their own address. A revoked key cannot be given.
• The purchase stays the buyer's: a subscription's billing and its renewal reminder stay with them. A buyer who gave away every key of a subscription sees it under Subscriptions you pay for, without its keys or devices. It has Manage billing while it is not revoked and billing can be opened, as above.
• Each move is recorded in the key's History and sends license.reassigned.

The key itself does not change. What the previous holder keeps depends on the key's Who can activate, unless it was sold as a license file:

Limits on giving

These are also in Rate limits.

• 100 gives an hour for each buyer.
• 5 an hour to any one email address, not counting keys given back to the buyer.
• 60 emails an hour for keys given out, across all your customers. Past that, a key still moves, without an email, and the page says so.

You can also move a key yourself: open it in your dashboard and choose Change beside its email.

A page for each product

Selling more than one product? Each can have its own page of your portal, at your portal's address and a path, such as licensing.yourcompany.com/myapp. Its customers see that product's licenses alone, in your branding, with the product's icon or logo beside it as its emails show them (or nothing, if its emails show nothing there).

1. Open the product, then its Settings tab, and turn on Customer portal.
2. The page takes an address made from the product's name, which you can change there: 2 to 40 lower-case letters, digits and single hyphens, different from your other products' addresses.

• One sign-in covers your portal and every product page.
• A sign-in link asked for on a product page goes only to an address that holds that product's licenses, and leads back to the page. While KeyGrant sends the product's emails, the link is sent as they are.
• While the page is on, the product's Manage license and Manage devices buttons go to it, unless its License delivery tab names a link of its own.
• Turned off, the page's address sends visitors to the same page of your portal. Change the address and the old one shows your portal's Page not found.
• The page shows only while your portal is on.

Links in your emails

While the portal is on, the Manage license button in a subscription's renewal reminder and the Manage devices button in the Device limit reached email go to it, or to the product's own page while that is on. A product whose License delivery tab names its own Manage license link uses that link instead. With the portal off and no link set, those emails have no button.

Your own domain

On a paid plan, the portal can open at a subdomain you own, such as licensing.yourcompany.com.

1. In Settings > Domains, choose Add a portal domain and enter the subdomain.
2. Publish the two DNS records it shows: a CNAME that points the address at KeyGrant, and a TXT that proves it is yours.
3. While the page is open and in view, it checks for them every 30 seconds, up to 20 times. After that, KeyGrant checks again each night, or you choose Check now.
4. Once both are found, Cloudflare issues the certificate, usually within a few minutes. If it is still pending a day after the TXT record is found, the page also lists Cloudflare's own TXT records to publish.

• One domain per tenant. It must be a subdomain, not the domain itself, and not a KeyGrant, workers.dev or pages.dev address.
• While it works, the Manage license and Manage devices buttons in your emails go to it.
• Without the TXT record for 7 days, the address stops working.
• If your plan ends, the domain keeps working for 14 days. After that, visitors are sent on to your portal.keygrant.dev address, and about 60 days later the domain is removed.