How can I manage subscription expiration in a Python desktop app?

Keep the subscription status on a server you control. The app can authenticate the user and request a short-lived license token. When it expires, the app checks back and gets a new one only if the subscription is still active.

Sign the token with a private key on the server and embed only the public verification key in the app. Include the expiration and whatever account or license identifier you need. Don't just trust a yes or no response from an endpoint. Use HTTPS and verify the token's signature and expiry locally.

OAuth 2.0 may help with user authentication, but an access token expiring doesn't by itself mean the subscription is valid. Your server still needs to check the subscription before issuing or renewing the license.

Decide how much offline use you want to allow. A license valid for a few days lets people use the app during a connection outage, but someone whose subscription expires may retain access until that license runs out.

A short validity period gives you faster expiration checks and makes the app more dependent on your server being available. Treat that as a product tradeoff rather than something cryptography can solve.

Don't count on a desktop client being tamper-proof. Someone with control of the machine can modify the program or its memory and bypass a license check. Cython can compile Python code into binary extensions and may raise the effort a bit, but it won't make the licensing scheme secure on its own.

For anything that really must remain under your control, consider whether it can run on your server instead of shipping it to the client. Then weigh that against hosting costs, privacy, and the need for a connection.