New GitHub releases and VirusTotal-checked files

Licensing that stops sharing, online or off.

OpenAuth binds license keys to devices, signs every reply so a fake server gets nowhere, and keeps your software running offline on device-bound leases. Start with one HTTPS request; drop in an SDK when you want the rest.

  • Free for 10,000 logins a month
  • Python and C# SDKs, or plain HTTPS
  • Import keys from KeyAuth or auth.gg
What your software sees on the signed API: a normal login, an offline activation, a reply from a fake server and a replayed reply.
$ client.login(key="OA-7Q2M-K9XD-4HPL")
→ POST /v2.php  action=login
  nonce  hG1v0dQ2dW4mS8pPq3Lz5vX9
  epk    P-256, made for this request
← 200 · 41 ms · eyJhbGciOiJFUzI1.eyJ2IjoyLCJhY3Qi.bXaz54VV…
✓ alg ES256 · typ oa-response+jwt
✓ signature verifies · kid f13358ad67d9
✓ nonce, aud and act match · exp in 300 s
✓ rcpt = thumbprint(epk)
ok class 2 · Standard · [core, export]
Signed API v2 · Python SDK
  • ES256Every reply signed
  • P-256Keys bound to each device
  • AES-256-GCMEncrypted replies and variables
  • 15 checksOn every login, in order
  • 90 daysLongest offline window
  • 10,000Free logins a month

01Platform

Everything between a sale and a running copy

Keys, tiers, devices, rules, remote config and your team, managed from one dashboard and enforced by one API.

Every feature

Tokens and classes

Generate up to 1,000 keys a batch, with an expiry date, your own text and a class for each tier you sell. Name your classes, give them features your software checks, and target them anywhere with a selector.

  • Bulk batches
  • Expiring
  • Custom text
  • Freeze
  • Notes
  • CSV import
Class selector try 2+, 1-3, Pro or 1, 9
Example classes
ClassNameFeaturesMatches
1Trialcore
2Standardcore, export
3Procore, export, pro-tools
9Staffcore, export, pro-tools, debug

Matches Standard, Pro and Staff

Keys or accounts

Customers type a license key, or sign in with a username and password. Accounts come with a customer portal where they redeem keys, download your files and move their own device.

Device and IP locking

The first login binds a key to that device or network, and every other one is turned away. Customers move devices from the portal or your Discord bot, with a cooldown you set.

Sharing detection

A key seen from more IP addresses or countries in 24 hours than one customer plausibly would is flagged. You get an alert, and OpenAuth can freeze it for you.

Access rules

Block or relax logins by country, class, device or IP. Turn away VPNs, proxies and hosting providers, and keep block and allow lists.

Release checks

Enforce the version, build ID and file signature of your releases, so old and modified copies can't sign in.

Variables

Send links, messages and settings inside the signed reply, to every class or only some. Keep values plain, Base64-encoded, or encrypted with a key only your software has.

Insights

Every login, activation and download, with its result, country and API version. Search by key, HWID or IP to answer "why can't this customer sign in?"

Team and resellers

Invite support staff, moderators, administrators and managers, each with exactly the access they need. Resellers generate keys within the allowance, classes and durations you set.

  1. Owner
  2. Manager
  3. Administrator
  4. Moderator
  5. Support
  6. Reseller

Automation

Create a key after every sale, look up a customer, or reset a device from your own server with the Management API. Each API key gets only the scopes it needs. Post logins to Discord, start from the Discord bot example, or connect your XenForo forum.

  • tokens:read
  • tokens:write
  • devices
  • variables
  • logs
  • releases
  • Discord bot
  • Login webhooks
  • XenForo add-on

02Security

Every shortcut around your license, closed

Pick a way someone might try to use your software without paying. Here's what stops it, and what their copy hears back.

Security best practices

AttackSharing one key with friends

DefenseHWID and IP locking, sharing detection

The first login binds the key to that device or network, and every other one is refused. Keys that still turn up from more IP addresses or countries in a day than you allow are flagged, and can be frozen automatically.

What their copy hears back

→ login  key=OA-7Q2M-K9XD-4HPL  hwid=9A04…B2C1
  bound to 7C1E…44F0 since 12 Oct
← hwid   This license is registered to another device.

PremiumHWID and IP locking docs

Every login runs the same 15 checks, in order

The first check that fails is the reply, so the code always tells you exactly where a login stopped. Frozen and expired keys are refused on every plan.

  1. 01API key belongs to an appconnection
  2. 02OpenAuth is onlineglobal
  3. 03Base monthly allowancepings
  4. 04Open access is offreturns class
  5. 05Matches the sign-in methodinvalid
  6. 06App is accepting loginsclient
  7. 07Key or account is validlogin
  8. 08Key isn't frozenfrozen
  9. 09Key hasn't expiredexpired
  10. 10VPN and proxy blockingproxy_blocked
  11. 11Access rulesregion_blocked
  12. 12Allow listskips the rest
  13. 13Block listblacklisted
  14. 14HWID lock, then IP lockhwid · ip
  15. 15Version, build and signatureversion · build · sig

Every plan Premium Every response, explained

03Signed API

A fake server can't say “valid”

Every reply is a JSON Web Signature, signed with your application's key and tied to the request that asked for it. Your software runs five checks before it believes a word.

  1. 1Unwrap. Take the JWS from jws, or decrypt it from enc.
  2. 2Verify the signature. ES256 over header and payload, with the public key built into your software.
  3. 3Match the request. nonce, aud and act are yours, and exp hasn't passed.
  4. 4Check the recipient. rcpt is the thumbprint of your one-time key.
  5. 5Then read it. status, class, features and vars.

The Python and C# SDKs do all five on every reply.

reply.jws ES256 · P-256

eyJhbGciOiJFUzI1NiIsInR5cCI6Im9hLXJlc3BvbnNlK2p3dCIsImtpZCI6ImYxMzM1OGFkNjdkOSJ9.eyJ2IjoyLCJhY3QiOiJsb2dpbiIsInN0YXR1cyI6Im9rIiwiY29kZSI6Im9rIiwibm9uY2UiOiJoRzF2MGRRMmRXNG1TOHBQcTNMejV2WDkiLCJhdWQiOiJhcHBfOEtxMldtIiwiaWF0IjoxNzkwMzUwMDAwLCJleHAiOjE3OTAzNTAzMDAsImNsYXNzIjoiMiIsImNsYXNzX25hbWUiOiJTdGFuZGFyZCIsImZlYXR1cmVzIjpbImNvcmUiLCJleHBvcnQiXX0.bXaz54VVhgYrbEVVJOlJzhjRJHj6JIFKsshcYmpdnX6a2JB6nzULtwlxgcQRp60yZtwwoLTplSvcjiNrknInbw

Header

{
  "alg": "ES256",
  "typ": "oa-response+jwt",
  "kid": "f13358ad67d9"
}

Payload

{
  "act": "login",
  "status": "ok",
  "nonce": "hG1v0dQ2…",
  "aud": "app_8Kq2Wm",
  "exp": 1790350300,
  "class": "2",
  "class_name": "Standard",
  "features": ["core", "export"]
}

Signature

64 bytes, r ‖ s. Only your application's private key can make it; your software checks it with the public key.

Verified

Reply encryption, if you want it

Signed replies can't be forged, but anyone who captures one can read it. Pick how much to hide. Every mode keeps the signature.

{
  "enc": "ECDH-ES+A256GCM",
  "epk": { "kty": "EC", "crv": "P-256", "x": "Wb3oVn0t...", "y": "k1Qz8Rdc..." },
  "iv": "3o9Yx2ZkQh7rLm0p",
  "data": "u2J0qV8cXo1d..."
}
What it does
Encrypts each reply to a key agreed for that request alone. No stored key to extract, and captured replies stay unreadable.
Your software needs
A fresh epk with each request. The SDKs send one.

04Offline licensing

Keeps working when the connection doesn't

Your software checks the license online once and receives a signed lease bound to that device. Customers keep working on a plane, behind a firewall or through an outage, and the lease renews itself when they're back online.

Offline licensing docs
Lease planner Administration › Offline

A device that's online renews after 3 d 12 h. One that stays offline keeps working for 7 days, then needs to connect once.

  • Signed, device-bound leases

    Each lease is signed with ES256 and names the one device key it was issued to.

  • Devices per key

    Allow 1 to 100 devices per key, and give each class its own limit.

  • Copying it does nothing

    The lease is stored encrypted and bound to a key that never leaves the device.

  • Clock tricks don't help

    Turning the clock back is detected, and a runtime budget ends the lease even if the clock is frozen.

  • Every renewal re-checks

    A revoked, frozen or downgraded key changes at the next renewal, along with its class and features.

  • Revoke any installation

    See every installation in the dashboard and revoke the ones you no longer trust.

05Releases and files

Ship updates through the same license check

Publish releases on channels, or let OpenAuth import them from GitHub. Your software asks for the newest version on its channel and gets the file only after its license checks out.

Update channels docs
  1. 01 · Publish git tag v1.5.0 A GitHub release, or a build you upload
  2. 02 · Import MyApp-*-win64.zip The webhook brings it in; a pattern picks the file
  3. 03 · Scan VirusTotal Held in quarantine until it's checked
  4. 04 · Release stable Latest on its channel, with your notes
  5. 05 · Update check_update() Downloaded after a license check, size and SHA-256 verified

Update channels

Put testers on beta and everyone else on stable. Add release notes, mark a release mandatory, and roll back by removing the bad one.

GitHub sync

Link a public or private repository and import its releases, or each commit that changes a build file. Store a copy on OpenAuth or send customers to GitHub. On Lite and Premium, call releases.sync from your CI.

Files behind the login

Keep program files and modules on OpenAuth and stream them only after a successful login, or offer them in the customer portal. Up to 6 files of 100 MB each on Premium.

VirusTotal on every upload

Nothing reaches customers before its check. A file is held for review only when 10 or more engines call it malicious. Labels that only describe what a tool is, such as PUA, HackTool, GameHack or Packed, are shown but don't count.

06Developers

One request to start. An SDK when you want the rest.

A login is one POST with a plain-text or JSON reply, from any language that speaks HTTPS. The single-file SDKs add signed replies, offline leases and updates.

  1. 1Create an application and copy its API key.
  2. 2Generate keys in bulk, or import the ones you already sold.
  3. 3Send the request, or add openauth.py or OpenAuth.cs to your project.
from openauth import OpenAuth

client = OpenAuth(
    api_key="YOUR_API_KEY",
    app_id="YOUR_APP_ID",
    public_key={"kty": "EC", "crv": "P-256", "x": "...", "y": "..."},
    product="my-product",
)

# Online the first time, offline after that.
lease = client.ensure(key=token_from_customer)

# Renew in the background; lock_the_app runs if the license is lost.
client.start(on_lost=lock_the_app)

if lease.has_feature("export"):
    enable_export()
Lease 2 Verified on the device: class, features and vars, valid offline for the window you set.

07Pricing

Start free. Upgrade when you need more.

Plans apply per application, so a free test app can sit next to a Premium product.

Plans and limits

Base

For trying OpenAuth and small projects.

Free

Start free
  • 10,000 logins a month
  • Bulk token generation
  • License keys or user accounts
  • Signed API, sessions and reply encryption
  • Named classes with features
  • Variables and update channels
  • GitHub releases and VirusTotal checks
  • Collaborators and activity log
  • 14 days of login history

Lite

For products that are growing.

€5.99/month

Choose Lite
  • Everything in Base
  • Unlimited logins
  • Custom tokens and deleting tokens
  • Management API and Discord bots
  • Import from KeyAuth, auth.gg or CSV
  • releases.sync from your CI
  • 30 days of login history
Compare every feature
Features by plan
FeatureBaseLitePremium
Tokens
Login requests10,000 / monthUnlimitedUnlimited
Bulk token generationYesYesYes
Freezing tokens and token notesYesYesYes
Named classes, features and class selectorsYesYesYes
Refusing expired and frozen tokensYesYesYes
Custom tokens and deleting tokensNoYesYes
Importing tokensNoYesYes
Generating expiring tokens and changing expiry datesNoNoYes
Class default durations and per-class device limitsNoNoYes
Protection
Signed API: signed logins and sessionsYesYesYes
Reply encryptionYesYesYes
HWID and IP lockingNoNoYes
Reset cooldownsNoNoYes
Access rules, VPN blocking, block and allow listsNoNoYes
Release checks and custom responsesNoNoYes
Offline licensingNoNoYes
Sharing detectionNoNoYes
Releases and files
Variables and update channelsYesYesYes
Linking a GitHub repository and update downloadsYesYesYes
Stored copies of GitHub release files10 MB each10 MB each100 MB each
releases.sync from your build pipelineNoYesYes
File streaming3 files, 10 MB each3 files, 10 MB each6 files, 100 MB each
VirusTotal check of uploaded filesYesYesYes
Team and automation
Insights and authentication log14 days30 days90 days
Collaborators and activity logYesYesYes
Management APINoYesYes
Discord login webhook and team messagesNoNoYes
ResellersNoNoYes

08FAQ

Questions, answered

Can't find what you need? The docs cover every setting, and the team is on Discord.

Do I need an SDK?

No. A login on the original endpoint is one POST request with a plain-text or JSON reply, from any language that can make HTTPS requests. The Python and C# SDKs are single files you add to your project when you want signed replies, offline leases and updates without writing the verification yourself.

What happens when a customer goes offline?

With offline licensing turned on, a successful activation gives the device a signed lease. Your software keeps working until the window you set runs out, anywhere from 20 minutes to 90 days, and renews the lease in the background once it's back online. Without it, treat a network error as a failed login.

How does HWID locking work?

Your software sends a device ID with every login. The first successful login binds the key to that device, and logins from any other device are refused with hwid. When a customer changes computer, reset the binding from the dashboard, or let them do it themselves from the portal or your Discord bot, with a cooldown. IP locking works the same way with IP addresses.

Can I move my keys from KeyAuth or auth.gg?

Yes. Export your keys from KeyAuth or auth.gg (or any spreadsheet) and upload the file under Control Panel > Import tokens. Classes, expiry dates and notes come along, and customers keep their existing keys. Importing is part of Lite and Premium.

Will VirusTotal hold my launcher because it's packed?

Not for that alone. Detections that only say what kind of tool a file is (PUA, HackTool, GameHack, or Packed and protectors such as Themida or VMProtect) are shown next to the file but don't count. A file is held for review only when 10 or more engines flag it as malicious.

Is my API key a secret?

No. The API key and the public signing key ship inside your software and can only check licenses, so it's fine if customers find them. Your secret key and Management API keys are the ones to protect: keep them on your own server and never put them in software you distribute.

Protect your next release

Create a free application in a minute. Upgrade to Premium when you want device locking, offline licensing and the rest.