Device Detectionn

This tends to be difficult for several reasons.

1) Every device will be running a different OS. Consider TracFones (millions upon millions of these devices in service). They all run a Java based OS, with no API services... or what you'd think of as API services, to determine a MAC address.

2) Android + iOS devices will likely throw up some sort of warning, depending version running, asking the user to allow access.

Imagine being presented some cryptic message about allowing some random code (your App) access to lowest level of machine hardware, which will likely include a suggestion to the user not to do this.

3) Here's the real kicker... Many mobile devices NAT through complex systems, where 1000s of devices connected to a given cell tower will return the exact same IP + MAC address.

So whatever you're trying to do, likely you'll find no solution which will work... even for a small percentage of devices.

4) There will never be a PHP/JS way to do this, as you're thinking about the wrong end of the connection.

This data must be acquired at the actual device + will never be correctly represented at the server side.

Simple Solution: All this said, all you require is a simple session management system (WordPress comes to mind) to ensure people have their own logins + if required, use WordPress bounce code which kills off any active sessions when a new person uses a user/pass combination.

Using simple bounce tech instantly gets rid of account sharing, because the original purchaser will start getting logged off (bounced) each time someone uses their login.

A clean way to stop account sharing.

I should  have also mentionned that this app would be used by 25 users... a max of 50 users

All users,  will accept and expect the mentionned "warnings" from this web applications.

MAC Addresses can only be read on the network the device is immediately connected to.  They do not pass thru routers.  You would have to read it with an app on the device itself.