Skip to main content
EVCore Studio requires a licensed account. This page explains how sign-in works, how licenses are issued and verified, how long Studio works offline, and how devices are registered to an account.

​
Sign-in and account creation

Studio uses Supabase Auth for accounts. You never store passwords yourself.
  • Create account — enter email and password in Studio. A confirmation code is sent to the email address. Type the code into Studio’s “Confirm your email address” screen to confirm the address and sign in.
  • Password reset — “Forgot password?” emails a reset code. Studio asks for the code and a new password, verifies the code, sets the password, and signs you in.
  • Resend code — Supabase allows one email per minute per address.
No free trial is offered. A new account has no license until one is bought.

​
License and offline use

After sign-in, Studio calls issue-license on the account server. The server checks that the user is signed in, the email is confirmed, and an active license exists, then returns a signed license document listing the account’s registered device serials. The license is signed with an Ed25519 private key that exists only on the server. Studio verifies the signature with the public key built into the app, so it can check the license offline and cannot be fooled by an edited file. The license expires 30 days after issue; Studio renews it whenever it is online (at start and every 6 hours). Studio also guards against a clock set back to extend the 30 days: it remembers the latest time it has seen and refuses licenses while the clock is earlier than that (10 minutes’ tolerance).

​
Editions: Studio and Studio Pro

One download serves both editions. The signed license’s plan field decides which features are on. A Pro feature opened on a Studio license shows what it does and how to upgrade; it never starts anything. Changing edition never needs a reinstall.

​
Registered devices

Licenses list the serial numbers of the account’s registered devices. Studio runs tests only on those devices. Simulators are exempt; their data is always labeled simulated. Device binding is enforced in public/core/device.js: Studio refuses to start a test on an unregistered USB device.

​
Purchase to license

The current flow uses Shopify:
  1. A customer buys a Studio or Studio Pro license at csharness.com (Shopify checkout).
  2. Shopify sends the paid order to the shopify-orders Edge Function (webhook, signed with the store’s webhook secret).
  3. The function records the order and creates the license at once if the email has an EVCore account. If not, the grant waits and is applied when that email signs up.
  4. The customer downloads Studio, signs in (or creates the account) with the order’s email, and Studio opens in the edition the license gives.
Rules:
  • Pre-order with beta access: the buyer gets the current beta at once and the license months start the day they buy. No free trial.
  • Refunds: full refund within 14 days of purchase. Refund a Studio order with Cancel order (with a refund) so the cancellation webhook revokes its license. A refund alone does not end it.
  • SKUs decide the license: EVC-STUDIO-6M (Studio, 6 months), EVC-STUDIO-12M (Studio, 12 months), and EVC-PRO-12M (Studio Pro, 12 months). Studio Pro is not for sale yet.
  • Test orders: Shopify test mode licenses only staff accounts.

​
Account server setup

The account service runs on Supabase. Setup steps:
  1. Create the Supabase project.
  2. Under Authentication > Providers > Email, keep “Confirm email” on.
  3. Under Authentication > URL configuration, set the site URL.
  4. Under Authentication > Emails > Confirm signup, paste the confirmation template and use the subject in its first comment.
  5. Link the server folder and apply the schema with supabase link and supabase db push.
  6. Generate the signing key with node scripts/license-keys.mjs generate.
  7. Store the private key as a function secret and deploy the issue-license function.
  8. Point Studio at the project with node scripts/license-keys.mjs server <url> <anon key>.
A packaged Studio refuses to run until all three settings are present in desktop/license-config.json. Development runs (npm start) have licensing off.

​
Day-to-day: granting licenses

Run these in the Supabase dashboard SQL editor. They are restricted to the service role.

​
Testing without Supabase

software/evcore-studio/desktop/license-dev-server.mjs is a local stand-in with the same endpoints and rules. Studio’s tests and its desktop smoke test use it. The smoke test creates an account, confirms it on the code screen, grants a license, and checks device binding.