License Authenticator

A Node.js microservice handling roughly 40,000 authentication requests a day at peak, with sub-10ms response times under load, every active client checked in at launch and on a regular interval, so reliability was not optional. Hardware binding computed a deterministic fingerprint from disk serial, CPU ID, and MAC address, HMAC-SHA256'd with a per-user salt and stored as machine identity; it survived OS reinstalls but broke on hardware swaps, which was the intended behavior.

Licenses were RSA-4096 signed JWTs, with the private signing key kept offline and never touching the server, the validation server held only the public key, performing verification plus a single indexed PostgreSQL lookup, which kept latency near-constant regardless of database size. Rate limiting ran per-fingerprint with exponential backoff, and a separate passive detection layer tracked distinct-fingerprint counts per license in a rolling window to catch anomalous usage patterns.