Better Auth License Tauri Plugin

Provides device-bound licensing for Tauri applications through encrypted activation flows and offline-verifiable JWTs.

This Tauri plugin is designed to be used together with the Better Auth License plugin:

It generates an X25519 device keypair, stores the private key securely in the OS keychain, exposes only the public key to the server, and handles all JWE encryption/decryption automatically.

All private keys, license keys, and tokens are securely stored using the native credential store (macOS Keychain, Windows Credential Manager, Linux Secret Service).

Install

This plugin requires a Rust version of at least 1.77.2

There are three general methods of installation that we can recommend.

1. Use crates.io and npm (easiest, and requires you to trust that our publishing pipeline worked)
2. Pull sources directly from Github using git tags / revision hashes (most secure)
3. Git submodule install this repo in your tauri project and then use file protocol to ingest the source (most secure, but inconvenient to use)

Install the Core plugin by adding the following to your Cargo.toml file:

src-tauri/Cargo.toml

[dependencies]
tauri-plugin-better-auth-license = "0.0.9"
# alternatively with Git:
tauri-plugin-better-auth-license = { git = "https://github.com/crabnebula-dev/better-auth-license" }

You can install the JavaScript Guest bindings using your preferred JavaScript package manager:

pnpm add @crabnebula/tauri-plugin-better-auth-license
# or
npm add @crabnebula/tauri-plugin-better-auth-license
# or
yarn add @crabnebula/tauri-plugin-better-auth-license

Usage

First you need to register the core plugin with Tauri:

src-tauri/src/lib.rs

use tauri_plugin_better_auth_license::Builder;

fn main() {
    tauri::Builder::default()
        .plugin(Builder::new()
            .with_license_server("http://localhost:5173/api/auth")
            .build())
        .run(tauri::generate_context!())
        .expect("error while running tauri application");
}

Capture the user license key input: Afterwards the plugin API are available through the JavaScript guest bindings:

import { update, remove, validate } from '@crabnebula/tauri-plugin-better-auth-license'

await update({ license: "AB-1234-0000" })

await validate()

await remove()

Validate license from Rust:

use tauri_plugin_better_auth_license::LicenseManager;

#[tauri::command]
pub async fn your_protected_command(
	manager: tauri::State<'_, LicenseManager>,
) -> tauri::Result<()> {
	manager.validate().await?;

	// your code
}

The plugin:

• Generates an X25519 device keypair on first run
• Stores it in the OS keychain
• Fetches JSON Web Key Sets (JWKS) from the server
• Encrypts outbound payloads using the server enc JWK
• Decrypts inbound JWE responses using the device private key
• Performs offline + remote JWT validation

No encryption logic is required in application code.

License

MIT or MIT/Apache 2.0 where applicable.