How Licence Keys Work on ModForge

If you have bought a protected product on ModForge you will have received a licence key that looks like MF-XXXX-XXXX-XXXX-XXXX. Here is exactly what it does.

Where to find your key

Dashboard → My Purchases. Protected products show the key alongside the download, with a copy button.

Your key is also in your purchase confirmation email. It is tied to your account permanently — you never need to worry about losing access to it.

What happens on first start

1. You install the product and enter your key.
2. On first startup the loader contacts ModForge to validate it.
3. The key activates and permanently binds to that server.
4. For encrypted products, the server receives a session key and decrypts the product in memory.

After that first activation, the key belongs to that server. Its status changes from active to used, and the bound identifier is recorded.

Why you cannot move a key

This is the most common support question, so to be direct: keys cannot be moved, unbound, or reset. Not by you, and not by support. There is no unbind function — only revocation.

The reason is that binding is the entire anti-piracy mechanism. If keys could be moved on request, anyone could buy one copy, install it, and pass it around by asking for a reset each time. A key that can be moved is a key that protects nobody.

The trade-off is real and worth being upfront about: if you rebuild your server from scratch under a new identifier, that key will not follow you. Running the product on a second server requires a second purchase.

Plan accordingly — activate on the server you actually intend to run, not on a test box.

What "protected" means per platform

Minecraft plugins ship encrypted. The jar on disk is not runnable on its own. A loader validates your key, receives a decryption key scoped to that session, and decrypts the plugin in memory. Nothing usable is ever written to disk, so even full filesystem access does not produce a shareable copy.

Roblox systems work differently, because Roblox files cannot be encrypted — the platform has to run them. Instead, your key binds to your Place or Universe ID, and the seller's script validates against it on startup. Sellers can additionally host their core logic on ModForge so it is served only to whitelisted games; that logic is never in the file at all.

Other product types are delivered as standard purchase-gated downloads: private storage, short-lived links, and download logging.

Download logging

Every download is logged with timestamp, IP and browser. Activations record the bound server and a last-seen time.

This is not surveillance of what you do on your server — it is how sellers detect one purchase being distributed to many people. It is disclosed in the Privacy Policy, and it is a large part of why sellers are willing to list protected work at all.

When keys get revoked

A key can be revoked for:

• A refund — you no longer own the licence.
• A chargeback — the payment was reversed or the card was stolen.
• Sharing or redistribution, which download logs make visible.

Revocation is permanent and disables the product. If you believe a key was revoked in error, contact support with your order ID.

If something goes wrong

Key will not validate: check it is entered exactly, with no trailing spaces, and that your server can reach ModForge — a firewall blocking outbound HTTPS is the usual cause.

Bound to the wrong server: this cannot be undone. Activate deliberately.

Plugin will not decrypt: confirm you are running the loader version the seller specified, and message the seller first — this is nearly always a version mismatch.

Seller unresponsive and product broken: open a dispute within 7 days of purchase.

For sellers

You do not implement any of this. Protection tier is derived automatically from the product type you choose — Minecraft plugins get encryption plus binding, Roblox scripts get whitelist validation. Upload your file and the platform handles key minting, binding, validation and revocation.

You can see every key for your products, its binding state and its last-seen time, and revocation for abuse is handled by admins on request.