Question

I will release my GAE application in a few months on a closed beta state, so that just a few users can use it and I get some date and know where and how to improve it. My idea was that I use a key system to let them access the application.

What I want to do:

I want to generate a punch of keys and store them with Datastore. When a users comes to the application the first time he logs in with his Google account and has to enter a key to activate his account.

My question:

My previous software didn’t require such license keys or similar so this is a new area for me. Do you think this is good way to realize a closed beta? My second idea was to generate a bunch of keys and validate them with a system like other popular software does it, but I think this is unnecessary and I wan’t to avoid a that someone can make a key-gen. Just generating, storing, then checking the key if it exists in the Datastore, setting it to used and activating the account would be my suggestion.

How can I generate a lot of valid and easily add more (without duplicates) keys. I’m thankful for every experience and suggestion.

Answer 1

As a refinement to Ashley’s suggestion, if you’d like to generate shorter and/or easier to type IDs, you can generate some random data and encode it using base32:

base64.b32encode(os.urandom(8)).strip('=')

Make it a bit more readable by inserting hyphens:

'-'.join(base64.b32encode(os.urandom(8)).strip('=')[5*x:5*(x+1)] for x in range(3))

This gives you codes like the following:

'C6ZVG-NJ6KA-CWE'

Then just store the result in your datastore and hand them out to users. I’d suggest storing the code without the hyphens, and stripping those characters before checking the database. If you want to get really fancy, base32’s alphabet is chosen to avoid characters that look similar; you could substitute those characters before you do the check to account for typos.

8 bytes of random data gives you 2^64 possible invite codes; if you hand out, say, 2^16 (65,536) of them, an attacker will still have to try 2^48 (about 300 trillion) codes to find a valid one. You can make your codes shorter at the cost of reducing the search space, if you want.