Originally published on the PermitCore blog .

"Is this license valid?" is often the wrong question. The more useful one is usually "what does this specific license unlock?" A Pro customer and a Team customer might both hold a genuinely valid key, but your app needs to know which of them gets the export button, SSO, or the API integration. That's feature-based licensing, and it's a field on the license key itself, not a separate system.

Where features live

Every LicenseKey has a FeaturesJson field: a plain JSON array of feature-flag strings, e.g. ["export","api","sso"] . You set this when you create a key (or define it once on a License Template so every key generated from that template inherits the same list), and it's returned in full on every validate() / activate() call, no separate endpoint required.

Reading it in your app

The response's features field is a plain string array.…