> For the complete documentation index, see [llms.txt](https://docs.nalpeiron.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nalpeiron.com/zentitle2-docs/developers/virtual-machine-control.md).

# Virtual Machine Control

Learn how Zentitle's nonce-based Licensing API prevents cloned virtual machines from abusing a single activation.

Today, most desktops are virtualized; the same has been true for servers for years. This means that Licensing has to deal with the issues related to impermanent storage and copying of deployed application instances.

{% embed url="<https://www.youtube.com/watch?v=1O8bXpw01Mc>" %}

**Abuse of VMs leads to lost revenues and improper use of the customer's IP.**

To help with managing VMs, Zentitle has created the concept of the [**Licensing API: Nonce**](https://docs.zentitle-sandbox.com/licensing-api/#section/Nonce)**.**

The API is using a nonce concept. Every request must contain a unique nonce value in the `N-Nonce` header. First, the Nonce is returned by the [Create Activation](https://docs.zentitle-sandbox.com/licensing-api/#tag/Activate/operation/Activate_Activate) endpoint. This nonce needs to be stored by the application and used in subsequent requests. Subsequent requests will return a new nonce, which needs to be used in the next request. Nonce values are returned in the `N-Nonce` header.

To learn more about the origins of a "nonce," [go here](https://en.wikipedia.org/wiki/Cryptographic_nonce).

{% hint style="info" %}
In the Licensing API, a **nonce** will ensure only one application instance uses a single activation. This should solve issues managing applications running on Virtual Machines in a connected environment.
{% endhint %}

Requesting the *Activate* endpoint will create and return a new **nonce** value. Other requests will require this exact value to be set on request headers. The API will verify the provided **nonce** and create/return a new one.

These are requests that require **nonce** to be present:

* get activation state
* activation refresh
* feature checkout
* feature return

The Deactivate endpoint will not check this value - this ensures activation is not left in a limbo state if the nonce was lost. Deactivate uses data from access-token to determine the correct seat to deactivate.

**Q**: What happens when a user clones a virtual machine, and the cloned machine does not have access to the internet?\
**A:** This depends on whether the machine was activated online or offline.

1. For offline activations, there is no real secure way to prevent cloning technically. ISVs should only allow offline activation for customers they generally trust. Or take into account that nothing offline without internet access is truly secure against cloning due to the lack of any real secure way to identify and lock to a virtual device without a way to check the number of running instances. Virtual machines, unlike physical devices, have no unique identifier that cannot be easily manipulated nor any secure API or secure storage provided by the developers of the VMs.
2. If the app in the VM was activated online, the clone can be used **until the lease period expires**. When this happens, all the clones must refresh the activation using the nonce mechanism. So, only the first clone will succeed. Others won't be able to refresh, and the activation will go into an **expired** state in any of the clones.<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.nalpeiron.com/zentitle2-docs/developers/virtual-machine-control.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.