Do I still need SHA256 if I already had a AES 256 key that is 44 characters long?
You don't say how SHA-256 is used in the PHP system, so there's really no way to know how "secure" it is.  At a guess, SHA-256 is being used as a key derivation function (KDF) on the input key material, so whether it provides any additional security will depend on the source of the input key material.  Of course, SHA-256 isn't great as a KDF - one would normally use something like HKDF (e.g. as documented in RFC 5869).


  a system that generates 256-bit long key


How this is generated is going to materially impact how secure your scheme is.

If it is generated by a cryptographically-strong random number generator (CSPRNG), then using a KDF on it is generally considered to be unnecessary.

If it is generated by a Diffie-Hellman key exchange, then it's important to use a KDF on the raw DH output.

If it's generated any other way, your whole scheme is likely to be insecure, whether or not SHA-256 is used.

But this is all based on a guess of how the various algorithms are used.

To get a better answer, you really need to tell us what the requirements are for your licensing system, what the thread model is (note that if this is a mobile app, they are considered to be run in an untrusted environment that an attacker has full control over, and various obfuscation and white-box crypto techniques are normally used too) and the details of the scheme.


  I am still new to the area of cryptography


Cryptography is one of the areas where it's always better to "buy" rather than "build" - don't roll your own.