How to protect extension?

Suppose I made an extension, I sold that extension to the user. Now that user is selling that extension to another user, then how do we protect?

Well, it is hard to stop it from happening. But you can try to prevent it from happening.

Keep a track of users whom you have sold the extension.
Someone with good knowledge of extension will surely bypass the authentication, so using it will only limit down the possibilities of piracy.