Question

I am going to offer a web API service that allows users to download and “rent” content for a monthly subscription fee. The API will either be open to everyone or possibly just select parties (not sure yet). Each developer must agree to a license, and they receive a developer key for their person. Each software application will have its own key as well. So then end-users will download the software which will interact with my service’s API. Each user will have a key for each application as well (probably using OAuth).

Content will be cached on first download and accessible offline via just the third-party application that cached the content.

If a user cancels their subscription, I plan on doing the following:

1. Deactivate the user’s OAuth key for all applications.
2. Do not allow the user’s account to download new content via the API (and subsequently any software that uses the API).

Now, the big question is: how do I make content expire if they cancel their subscription? If they cancel, they should not have access to content anymore. Here are ideas I’ve thought of (some of these are half-solutions, not yet fully fleshed out):

1. Require that applications encrypt downloaded content using the user’s OAuth key, making it available to only the application. This will prevent most users from going to the cache directory and just copying and keeping files.
2. Update the user’s key once a month, forcing content to re-cache on a monthly basic. Users could then access content for a month after they cancel their subscription.
3. Require applications to “phone home” [to the service] periodically and check whether the user’s subscription has terminated. If so, require in the API developer license that applications expire cache. If it is found that applications do not comply, their keys (and possibly keys for all developers) are permanently deactivated as a consequence.

One major worry is that some applications may blatantly ignore constraints of the license. Is it generally acceptable to rely on applications abiding by the licensing constraints? Bad idea?

Any other ideas? Maybe a way to make content auto-expire after x days? Something else? I’m open to out-of-the-box ideas.

Answer 1

If you want to control the usage of content, you need to be in control of the access point. Most applications that implement this scheme ship a server or client product that provides access to the content.

I’m assuming your architecture is returning data, pure and simple. If I’m a developer using your web service, what is to prevent me from caching all the responses in static files elsewhere at query time? Nothing, because your access point is your web server. You have no control over my usage of the content once it departs from the access point.

Unless the downloaded content requires a callback to your server when being consumed, you’re out of luck with this strategy.