Methods and apparatuses, including computer program products, are described for authenticating the usage of an application. A request to execute an application is received from a user device. The application is executed based on the request. An application-level usage indicator is received from the user device. The application-level usage indicator corresponds to current operation of the application by a user and comprises at least (i) user input commands and (ii) passive usage metrics. The identity of the user is determined by comparing the application-level usage indicator with a pre-established user profile wherein the user profile is associated with previous operation of the application by the user and comprises at least (i) user input commands and (ii) passive usage metrics. Execution of the application is terminated at the user device if the identified user is not entitled to use the application according to the user profile.