The check that feels like a lock
Most of us started here. You want to stop your EA from running on accounts that didn't pay, so you drop something like this near the top of OnInit() :
It compiles, it blocks the wrong account, and it feels done. It isn't. The trouble starts after the sale — which is the only time license protection actually matters.
Three problems that show up after delivery
Recompile per customer. The allowed account is a constant in the source, so every new buyer needs an edit and a fresh compile. At ten customers it's tedious. At fifty it's a job you'll eventually rush, and a rushed license edit is how a build that runs on any account gets shipped by accident.
No off-switch. When a copy leaks — and .ex4 files leak, usually within days of release — you have no way to revoke that specific copy. The account number is already compiled in. Changing the check and re-releasing does nothing about the copies already circulating.
No trial, no visibility. A hardcoded check is binary: full build or nothing. You can't grant a two-week trial without hand-editing an expiry, and you have no record of who is actually running what.
The deeper issue is location: the check lives inside the artifact you're trying to protect. Anything shipped with the product travels with the product.
What actually moves the needle
Real license control has to live outside the compiled file and answer three questions at runtime — is this account licensed, is this specific copy still allowed, and is this a trial that has expired? That means a call out to something you control:
The difference isn't the syntax — it's where the decision is made. When verification happens on a server you own, you can bind a license to an account, disable a leaked or charged-back copy remotely, and expire a trial, all without touching the customer's build. The account number stops being a secret baked into source and becomes a lookup.
You can build this yourself: a small API, a database of accounts and statuses, an auth layer, uptime, and — importantly — a graceful fallback for when the network hiccups mid-session, so a single dropped request never kills a live EA. It's a real backend. That's the honest trade-off: DIY costs nothing but your time to run it.
Takeaway
If your protection is an if on the account number, you are managing nothing after delivery. The moments worth protecting — a leaked copy, a chargeback, a trial that should expire — are exactly the moments a hardcoded check can't help. Move the decision outside the file, and license management becomes something you can actually do.
(For anyone who would rather not run the backend, LicenseShield is our hosted version of exactly this — account-bound verification, remote disable, and auto-trial in three lines, under 100ms, free tier included. The principle stands whether you build it or buy it.)
