I'm building a chrome extension that I would like to offer for free for a given trial period and then the users buys a registration key on our website for a forever version .
I've built software previously, but I've never made something paid.
Using my basic knowledge of cryptography and membership websites, I thought of the following :
When the user installs the extension for the first time it create a variable for the registration key with an empty value, which means that the user hasn't bought the product yet and they are in a trial period.
Once the user opens the extension it will check if the trial period has ended by doing date computations .
If the trial has ended the user will have a form for his email and registration code.
The user buys the registration code on our website. We process payments via stripe, and as a callback the server will create a hashed key based on their email . It will also hash a string based on the browser ID they're using to make sure that the paid version works only on one platform. After that it will save all those hashed keys in a DB by email.
The registration code is sent to the user via email
The user can now reopen the extension and enter their email + registration code . The extension send an Ajax request to the server with the entered mail and key.
the server check the sent data with the data stored in the DB .
the extension acts on the status of the response .
I don't know if this is the right approach to solve this. Is there a better and more secure approach? How quick are those method to build? Are there ready-made APIs that take care of situations like this?
The software is a chrome extension built in JS and offered for free on the chrome store, so an average user can access its code. An average hacker would be able to reverse engineer it and crack it, making torrents of a cracked version and so on.
I intend to build the backend via Python and flask.