Licensing

License models

TontonTools offers three license models depending on the product. Each product clearly states which model applies on its pricing page.

Which tier unlocks which tool

The TontonTools suite is sold in three subscription tiers. Each tier includes everything from the tiers below it, plus additional tools.

The SCCM to Intune App Migrator is sold separately as a one-shot license, in three tiers based on the number of applications you need to migrate: Small (up to 50 apps), Medium (up to 200 apps), Large (unlimited).

Activation flow

When you first launch a TontonTools product, the license dialog asks for a license key. The activation flow is:

1. 1

   Paste your license key

   The key is the UUID you received by email from Lemon Squeezy after purchase. The dialog masks the input for privacy.

2. 2

   The product calls POST /v1/licenses/activate on the Lemon Squeezy License API

   Over HTTPS / TLS 1.2+ to api.lemonsqueezy.com. The request carries only your license key and a machine-derived instance name (hostname-username). No tenant data is transmitted.

3. 3

   Product binding check (anti-cross-product)

   The response includes store_id, product_id, and variant_id from your purchase. The product verifies these match the expected identifiers compiled into the application — so a license key for one product cannot activate a different product.

4. 4

   Local storage

   On success, the license info is stored DPAPI-encrypted in %ProgramData%\TontonTools\licenses\<ProductCode>.lic. The instance ID returned by Lemon Squeezy is recorded for subsequent validate calls.

5. 5

   Machine and tenant binding

   A machine identifier (SHA-256 hash of the Windows MachineGuid and the BIOS UUID) is computed and stored with the license. If you have configured Graph credentials, the current Entra ID Tenant ID is also recorded.

Trial mode

Every TontonTools product can be evaluated for 14 days without entering a license key. Click "Start free trial" on the license dialog at first launch.

• Local generation The trial license is generated on your workstation. No request is made to Lemon Squeezy. No email, no name, no payment method.
• Machine-bound The trial is tied to a SHA-256 hash of your Windows MachineGuid and BIOS UUID. Copying the trial file to a different machine renders it unusable.
• Anti-reset When a trial expires, the product remembers this fact. Deleting the trial file does not reset the clock — a fresh 14-day period cannot be regenerated on the same machine.
• Fully featured No feature is hidden behind a "trial unlock". The Preview / Dry-Run, deletion, rollback snapshot, bulk import, and audit logging all work during the trial exactly as in a paid license.
• Conversion to paid When you enter a real license key at any point during or after the trial, the trial file is removed and the standard activation flow takes over. You do not lose your credentials or your local configuration.

Periodic validation and offline tolerance

After activation, the product validates the license periodically against the Lemon Squeezy License API. The schedule is:

In practice: a workstation that is online once a week has zero perceived license overhead. A workstation in a strict offline environment has a 14-day window between connectivity events.

Read-only mode

Read-only mode is the graceful degradation behavior that activates when:

• The license validation has failed for more than 14 consecutive days (offline grace period exhausted), or
• Your subscription has reached its PaidUntil date (the end of the period you paid for), or
• Your license is bound to a tier that no longer covers this specific tool (e.g. the tool moved to a higher tier).

What read-only mode does

• Disables every destructive action (Delete, Migrate, Reclaim, etc.).
• Disables write-side previews where applicable.
• Keeps the Credentials dialog accessible — you can still update tenant or SCCM settings.
• Keeps Activity Log, Export Log, and existing rollback snapshots accessible — for post-incident review.
• Displays a persistent banner offering to enter a license key or contact support.

In short: TontonTools never silently stops working. Destructive operations stop, but the diagnostic surface stays available. Restore full functionality at any time by entering a valid license key or by reconnecting to the license server.

Machine and tenant binding

Each license is bound to two identifiers, captured at activation:

• Machine identifier A SHA-256 hash of the Windows MachineGuid (HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid) concatenated with the BIOS UUID (Win32_ComputerSystemProduct.UUID). Stable across Windows updates and user profile changes. Changes when you reinstall Windows or change the motherboard.
• Tenant identifier If you have configured Microsoft Graph credentials, the current Entra ID Tenant ID is also recorded. A license activated with one tenant cannot be used to operate against a different tenant.

These bindings exist to prevent license resale and to make administrative auditing simpler — a stolen license key cannot be activated on an arbitrary machine, and a contractor cannot accidentally operate against the wrong customer tenant.

Moving a license to another machine

Subscriptions and one-shot licenses can be moved between workstations. The procedure:

1. 1

   On the source workstation

   Open the License dialog (visible from the in-app "License" or "Buy a license" button). Click Deactivate. The product calls POST /v1/licenses/deactivate to release the instance on the Lemon Squeezy side, then removes the local .lic file.

2. 2

   On the destination workstation

   Launch the same TontonTools product. The license dialog appears. Paste the same license key and click Activate. The product calls /v1/licenses/activate with a new instance name. Lemon Squeezy issues a new instance ID, the local .lic file is created, and you are operational.

3. 3

   If you forgot to deactivate first

   Use the customer portal (link below) to deactivate the orphaned instance, or contact support@tontontools.com. Each license has an activation limit (typically 3 simultaneous activations) — if you hit it, /v1/licenses/activate returns a clear error rather than silently failing.

Subscription cancellation and renewal

If you cancel a subscription, the product reflects this in two stages:

• Until PaidUntil The subscription is marked as cancelled in the license cache, but full functionality continues. You paid for the period and you keep using it. A non-intrusive banner notes that the subscription will not renew.
• After PaidUntil The product enters read-only mode. Reactivate by reopening the subscription on Lemon Squeezy (your billing data is preserved on their side) or by purchasing a new subscription.

Renewal is automatic for active subscriptions. The next /v1/licenses/validate call after PaidUntil — assuming the renewal payment succeeded — refreshes the cache with a new PaidUntil and the product continues normally.

Customer portal

Lemon Squeezy provides a customer portal where you can view your active subscriptions, change your payment method, download invoices for VAT and accounting purposes, cancel a subscription, and deactivate orphaned instances. The portal URL is included in every invoice email from Lemon Squeezy. You can also access it from the TontonTools customer area at /account.

SCCM to Intune App Migrator — tier-specific notes

The SCCM to Intune App Migrator is the only TontonTools product sold as a one-shot license. Three tiers control the maximum number of applications migrated per project:

The limit is checked against the cart contents before the migration starts. If you exceed it, the product displays the current tier, the cart size, and a direct upgrade link. No partial migration is started — you fix the cart or upgrade first.

Troubleshooting common license errors

"No license found on this machine"

You launched the product before activating a license, and no trial is active. Click "Enter license key" on the License dialog and paste your key, or click "Start free trial".

"This license belongs to a different product"

You entered a key from a different TontonTools product. Verify the key against the purchase email and the product name on the Lemon Squeezy receipt. If you have multiple TontonTools subscriptions, each one ships its own dedicated key.

"This license is registered for a different machine"

A .lic file was copied between workstations (the file is bound to the source machine and cannot be decrypted elsewhere) or the underlying hardware identifiers changed (Windows reinstall, motherboard replacement). Deactivate the license from the original workstation if possible, then activate it freshly here.

"This license is registered for a different tenant"

The license was activated against one Entra ID tenant, but the current Graph credentials point to another. Either change the Graph credentials back to the original tenant in the Credentials dialog, or deactivate the license and reactivate it for the new tenant.

"Activation limit reached"

The license has been activated on the maximum number of simultaneous workstations. Open the customer portal, identify the orphaned instances, and deactivate them. Alternatively, contact support@tontontools.com to request a reset.

"Network unreachable — operating in offline grace period"

A scheduled validation call to api.lemonsqueezy.com could not complete. The product continues normally for up to 14 days from the last successful validation. Restore connectivity at your convenience — most often this is a proxy or strict-firewall issue. Outbound HTTPS to api.lemonsqueezy.com is the only allow-list entry needed for license validation.

Other error messages

For any other licensing error, capture a screenshot of the dialog and the relevant section of the application activity log, then contact support@tontontools.com. Include your license key (or its last 6 characters), the product name, and the workstation hostname.

What the license system transmits and stores

Per Security & Data Handling, the license subsystem is the only part of TontonTools that talks to TontonTools infrastructure. Every other operation goes directly from the workstation to Microsoft (Graph, AD, SCCM). The license subsystem transmits only:

• Your license key (entered by you at activation).
• A machine identifier — the SHA-256 hash computed from MachineGuid and BIOS UUID.
• An instance name — typically hostname-username, used as a human-readable label in the customer portal.
• The product code and version.

No tenant data, no device inventory, no user data, no credentials. The destination is api.lemonsqueezy.com over HTTPS / TLS 1.2+. Lemon Squeezy stores your purchase information for billing and tax compliance; TontonPro SASU receives aggregated payout reports without per-customer detail by default.