Licensing and entitlement control plane for identity-governed applications. Vinzy-Engine generates cryptographic license keys, resolves per-feature entitlements, meters usage, and detects anomalies -- behind an API designed to operate under the identity authority of a zero-trust platform.
Vinzy-Engine is the licensing counterpart to Zuultimate, which handles identity, authentication, and authorization. When a payment webhook arrives (Stripe or Polar), Vinzy-Engine creates the license and then provisions a tenant in Zuultimate via service token, returning credentials and an API key scoped to the customer's plan tier. The full integration contract is documented in ZUULTIMATE_CONTRACT.md. Vinzy-Engine degrades gracefully if Zuultimate is unreachable -- license creation proceeds, and tenant provisioning retries on the next opportunity.
| Capability | Status |
|---|---|
| License Key Generation (HMAC) | GA |
| Entitlement Resolution | GA |
| Multi-License Composition | GA |
| Machine Activation | GA |
| Usage Metering | GA |
| Anomaly Detection | GA |
| Audit Trail (hash-chained) | Enterprise |
| Webhook Dispatch | GA |
| Multi-Tenant Isolation | Enterprise |
| Zuultimate Integration | Enterprise |
| Admin Dashboard | Enterprise |
| Stripe/Polar Webhooks | Enterprise |
# Install
pip install -e ".[dev]"# Start the server
vinzy serve
# Create a product
curl -X POST http://localhost:8080/products \
-H "X-Vinzy-Api-Key: $VINZY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"code": "PRD", "name": "My Product"}'# Issue a license
curl -X POST http://localhost:8080/licenses \
-H "X-Vinzy-Api-Key: $VINZY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"product_code": "PRD", "customer_id": "<customer-id>"}'# Validate (public, no auth)
curl -X POST http://localhost:8080/validate \
-H "Content-Type: application/json" \
-d '{"key": "PRD-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"}'{PRD}-{AAAAA}-{BBBBB}-{CCCCC}-{DDDDD}-{EEEEE}-{HHHHH}-{HHHHH}
| | |
| +-- 5 random base32 segments +-- 2 HMAC segments
+-- 3-char product code
The first character of the first random segment encodes the HMAC key version (0-31), enabling seamless key rotation without invalidating existing keys.
pytest tests/ -qThe community edition ships a comprehensive pytest suite for key generation, licensing, activation, usage, anomaly detection, and webhooks. Audit trail, multi-tenancy, provisioning, and the admin dashboard are Pro/Enterprise features — see https://gozerai.com/pricing.
This project is dual-licensed:
- AGPL-3.0 -- free for open-source use. See LICENSE.
- Commercial License -- for proprietary use without AGPL obligations. See COMMERCIAL-LICENSE.md.
For commercial licensing inquiries, contact info@gozerai.com.
Copyright (c) 2025-2026 Chris Arsenault / 1450 Enterprises.