To access the paid bits, you log in with your email (passwordless: it emails you a code to login) either online (https://httptoolkit.tech/get-pro/) or in the app itself, and you complete an online checkout (managed by Paddle.com) to subscribe for X duration.

As long as you're logged into the app itself, it makes a check on startup with your auth token to see if your current subscription is still active. If it's active, all the paid features turn on.

No passwords, no license keys, auth & subscription data storage managed by Auth0, and one tiny accounts server that glues the checkout & auth0 together (which is also open source: https://github.com/httptoolkit/accounts/).

That's the normal flow, but assuming you don't change the code it works the same whether you use the hosted deployment or you fully self-host the core app.