OEM, White-Label, and Reseller Licensing: Letting Partners Provision Keys Without Your Admin Token

Direct licensing has one issuer: you. OEM, white-label, and reseller channels break that assumption — now partners issue keys to their customers, under their brand, on their schedule, and you are not in the loop for each sale. The naive solutions are both wrong: handing partners your admin token gives them the keys to your whole kingdom, and routing every partner sale through your team manually does not scale and defeats the point of a channel. The right model is scoped, attributed, capped provisioning — and it is mostly a matter of what you put in a token and in the signed key.

The three problems a channel creates

Selling through partners raises three distinct questions that direct licensing never has to answer:

1. Authority — how does a partner mint keys without being able to mint anything? They must be confined to their product, their tier, their quota.
2. Attribution — when a key activates, which partner provisioned it? You need this for revenue share, royalties, and scoped support, and it must be forgery-proof.
3. Isolation — a partner must never see, revoke, or interfere with another partner's (or your direct) customers.

All three are solved by two mechanisms: a scoped provisioning token per partner, and a partner claim inside the signed key.

Scoped provisioning tokens

Instead of your admin credential, each partner gets a provisioning token whose authority is bounded to exactly what the agreement allows:

• a product/tier it may issue (and no others),
• a quota — a maximum number of keys or seats, or a value cap,
• an expiry on the token itself,
• and no read/revoke access to anything it did not create.

The partner calls a provisioning endpoint with that token to mint a key on demand (or you pre-generate a block and hand it over). The issuing service enforces the quota as they go and refuses once it is reached. A partner who leaks or abuses their token can only ever damage their own allocation — never your catalog, your pricing, or another partner's customers.

// Partner side: mint a key within the partner's scope (no admin token involved).
var key = await channel.ProvisionAsync(new ProvisionRequest {
    Product = "acme-suite",
    Tier    = "pro",
    Seats   = 5,
    Customer = "end-customer-ref",   // partner's own reference
});
// The service checks the partner token's quota/product scope and refuses if exceeded.

The partner claim: attribution that cannot be forged

Every key a partner issues carries a partner/reseller claim stamped into the signed payload — partnerId, and whatever else you need for accounting. Because it is inside the signature, it is tamper-evident (editing it breaks validation) and it travels with the key forever. That gives you, without any trust in the partner's own records:

• Revenue share / royalties — sum activations by partnerId.
• Scoped support — a key presented to support identifies its partner instantly.
• Scoped revocation — revoke by partnerId to unwind a terminated partner, affecting only their keys (revocation strategies apply per-partner).

This pairs naturally with product claim suites when a partner resells a bundle, and with entitlements when their tier unlocks a different feature set than your direct one.

White-label: making the vendor invisible

A true white-label deployment goes one step further: the end customer should not see you at all. Two pieces make that work. The key format and activation messaging carry the partner's branding rather than yours. And each partner can be given its own signing identity (or product), so the keys validate against a public key the partner embeds in their branded build — the cryptography is scoped to them. The licensing engine is yours; every surface the end customer touches is the partner's.

Doing this with Keyright

Keyright supports this channel model directly: issue each partner a scoped provisioning token (bounded by product, tier, and quota), stamp a partner claim into every signed key for forgery-proof attribution, and keep revocation and reporting scoped per partner — all without ever sharing your admin credentials. Partners provision on demand through the API or from pre-generated blocks, and white-label partners get their own signing identity so your name never appears. Because Keyright is self-hosted, the signing keys and all partner and customer data stay on infrastructure you control.

See the plans, or start from automating license fulfillment and add a partner scope to the issuance.