Third-Party Licenses: How to List and Show Them
Third-party licenses are the licenses of the libraries your app uses. Here's how to create and maintain the list.
Overview & context
Third-party licenses are the licenses of the libraries, frameworks, fonts and other components your app uses and you didn't write. Permissive licenses such as MIT and Apache 2.0 require you to keep the copyright notice and the license text, so you need a list of components with their licenses and a place where users can find it. Below is how to build that list from a project file, what to record for each component and where to show it.
1. What third-party licenses require
A third-party license sets the conditions for using and distributing someone else's component in your app. The conditions depend on the license type, so a list of components with their licenses is the starting point for open source license compliance.
The article on open source licenses covers the differences between MIT, Apache 2.0 and GPL in detail. For the component list, you only need to know which row of the table a license falls into.
| License type | What it requires when you distribute the app | Examples |
|---|---|---|
| Permissive | Keep the copyright notice and the license text; Apache 2.0 also asks you to mark changed files and pass on the NOTICE file | MIT, BSD, ISC, Apache 2.0 |
| Weak copyleft | Publish your changes to that library; the rest of the app can stay closed | LGPL, MPL 2.0 |
| Strong copyleft | Provide the source code of the whole derived work under the same license | GPL, AGPL |
2. How to build a list of libraries with their licenses
You build the list of libraries and licenses from a project file that names the app's dependencies, such as `package.json`, `pom.xml` or `Cargo.toml`. There's no need to copy licenses from each library's repository by hand.
- 1
Load the project file into a tool
Open the npm license checker and paste or upload your `package.json`. There are the same tools for NuGet, Python, Composer, Rust, Go, Flutter, CocoaPods, Swift, Java and Android, all among the free tools. The file is processed directly in your browser.
- 2
Add a file with exact versions
`package.json` gives you the direct dependencies and their version ranges. If you also upload a file with locked versions, such as `package-lock.json`, the list contains the specific versions you actually install.
- 3
Decide about dev dependencies
Dev dependencies are left out by default. Tick the option only if their code ends up in the app you deliver to users.
- 4
Review the license summary and warnings
The tool counts the dependencies, groups licenses into permissive, copyleft and unknown, and flags packages to review. Start with the unknown and copyleft ones (section 6).
- 5
Export the result
You can download the list as CSV, Markdown or CycloneDX. The Markdown file `THIRD-PARTY-LICENSES.md` is meant for storing in the source code repository.
3. What to record for each component
For each component, record the name, version, license, link and category. Write the license as an identifier from the SPDX list, for example `MIT`, `Apache-2.0` or `GPL-3.0-or-later`, because tools can compare it unambiguously.
| Field | What to enter | Example |
|---|---|---|
| Name | Package or library name | react |
| Version | The version the app actually contains | 18.3.1 |
| License | License identifier, or your own text | MIT |
| URL | Repository or package page | github.com/facebook/react |
| Category | Framework, library, font, icon set and so on | Framework |
| Description | Optional note on what the component does in the app | User interface |
4. Where to show third-party licenses
Show third-party licenses where users and support can reach them easily: inside the app and on a public page about the app. A file in the repository isn't enough, because customers and support usually don't have access to it. The article on the About screen describes what a licenses screen in the app should look like.
In AboutTheApp you maintain the component list in the Components & Licenses window, which you open with the Components icon on the app's card. The Import dependencies button loads the dependencies from your project file and shows which components are new, changed or unchanged. You save only the ones you choose. You can then add or edit any component by hand, including its category and description.
Each component can be public or private. The About page shows public components in the Components & Licenses tab, even to visitors who aren't signed in. Inside your app they appear in the Credits & Licenses About box. Private components are visible only to team members or to someone with the unlock code.
5. How to keep the license list current
The license list goes stale with every new dependency or library update. After you change the project file, run Import dependencies again: components marked Changed have a different version or license than the one you recorded, so you also see when a library changes its license.
If you build the app with an AI assistant, put a rule in the spec that the assistant doesn't add libraries without your approval and a license check. The PRD template shows where to put that rule, and the article on building an app with AI covers the wider workflow. For a machine-readable component list that security and license tools can read, use the SBOM generator.
6. Which licenses need a closer look
Three cases need the most attention: a copyleft license in a closed app, an unknown license and a component with no license. With GPL and AGPL you have to provide the source code of the derived work when you distribute the app, so check whether the component really ships with it.
An unknown license means the tool couldn't find or recognize it in the registry. Open the component's repository and look for the `LICENSE` file. According to GitHub's documentation, only the author may copy and distribute code without a license, so avoid such a component until the author adds one.
This article is for general orientation. If a license affects your business model or your contracts with customers, talk to a lawyer.
Frequently asked questions
What are third-party licenses?
They're the licenses of libraries, frameworks, fonts and other components that an app uses and its author didn't create. Each license sets the conditions for using and distributing the component.
Do I have to show library licenses in my app?
Permissive licenses such as MIT and Apache 2.0 require you to keep the copyright notice and the license text in all copies. For a distributed app that's usually done with a licenses screen or an attached file. The exact requirement comes from the text of each license.
How do I find the licenses of my npm dependencies?
Paste your package.json into an npm license checker. It loads the licenses from the registry, groups them into permissive, copyleft and unknown, and lets you export the result as CSV, Markdown or CycloneDX.
What does an unknown license on a package mean?
The tool didn't find the license in the registry or didn't recognize it. Open the package's repository and check the LICENSE file. Until you know the license, you don't know the conditions for distributing the package.
Should dev dependencies be on the license list?
Only if their code ends up in the app you ship to users. Testing and build tools usually don't, which is why dev dependencies are left out by default.
What's the difference between a license list and an SBOM?
A license list is an overview for people: component, version, license and link. An SBOM is a machine-readable file, for example in CycloneDX format, that also carries component identifiers and is processed by security and license tools.
How do I show third-party licenses in AboutTheApp?
In the Components & Licenses window of your app, import the dependencies from your project file. Public components appear on the About page in the Components & Licenses tab and in the Credits & Licenses About box.
In short
Build the list of third-party licenses from the project file, keep it with the app and show it where users and support can find it. Update it whenever you add a library.
AboutTheAppWant the licenses of your components with the app?
Create a free app in AboutTheApp, import its dependencies and show the licenses on the About page and inside your app.