How we license our MT5 EAs without keys, account locks, or DLL wrappers

Most EA licensing methods (key inputs, account-number locks, DLL wrappers) treat paying customers as the threat, fire a support ticket on every reinstall, and still get cracked. Here's the approach we settled on instead.

The setup, three parts:

• Entitlement lives on a server you control (this email owns this product).
• The EA asks one HTTPS endpoint a single yes/no question on a slow timer.
• The answer is cached in a local, fail-closed state file. Trading reads only that file, never a live HTTP response.

The parts that matter:

• HMAC-SHA256 signed request bodies with a timestamp + nonce, for replay protection.
• A 24h grace window so a VPS DNS blip doesn't strand a paying customer mid-session.
• A 48h staleness ceiling, so firewalling the endpoint isn't a free bypass.
• Stop NEW trades on a lapsed licence, never force-close open positions.

Full writeup with working MQL5 + ASP.NET code (and a downloadable example): stratotank.com/ideas/securing-ea-license-checks

Curious how others handle the fail-open vs fail-closed tradeoff.