OpenAuth locks license keys to devices, signs every answer so fake servers get nowhere, and keeps your software running offline with device-bound leases. Add it with one HTTPS request.
Features
Keys, devices, releases, files and your team, managed from one dashboard and enforced by one API.
Generate keys in bulk, up to 1,000 per batch. Give them an expiry, your own text and a class for each tier you sell. Freeze a key without deleting it, and move existing customers over with CSV import from KeyAuth or auth.gg.
Customers enter a license key, or sign in with a user account. User accounts come with a customer portal where they redeem keys and download your files.
Lock each key to one device (HWID) or IP address. Set access rules by country or class, block VPNs and proxies, and keep block and allow lists.
Keys used from too many IP addresses or countries are flagged. You get an alert, and OpenAuth can freeze the key for you.
Enforce version, build ID and file signature so old or modified builds can't sign in. Ship updates on channels with release notes.
Stream program files only after a successful login, or offer direct downloads in the customer portal.
Deliver remote config inside signed responses, with different values for each class. Change behaviour without shipping a build.
See every authentication request and its result, follow success rates over time, and get alerts when something needs a look.
Invite teammates as Support, Moderator, Administrator or Manager. Give resellers accounts with a token allowance. An activity log and team chat keep everyone in step.
Script your licensing with the Management API and keys scoped to exactly what they need. Start from the Discord bot example, post logins to Discord with webhooks, or connect your XenForo forum with the add-on.
New Offline licensing
Your software signs in once and receives a signed lease for that device. Customers keep working on a plane, behind a firewall or through an outage, and the lease renews itself when they're back online.
A normal login succeeds and OpenAuth issues a lease, signed and bound to this device.
Lease issuedYour software verifies the lease on the device. No network needed until the window ends.
Verified locallyBack online, the lease renews in the background and your current policy is checked again.
Policy re-checkedSteps 2 and 3 repeat for as long as the license stays valid.
Each lease is signed with ES256 and names the one device it was issued to.
Allow anything from 20 minutes to 90 days offline, to match how your customers work.
The lease is encrypted on the device and bound to a key that never leaves it. On another PC it won't open.
Turning the clock back is detected, and a runtime budget ends the lease even if the clock is frozen.
Each renewal re-checks your policy, so a revoked or frozen license stops at the next renewal.
See every installation in the dashboard and revoke the ones you no longer trust.
New Signed API
Every response is signed with your application's key and tied to a one-time nonce from your software. A cloned server or a hosts-file redirect can't produce that signature, and a recorded answer can't be replayed.
{
"act": "login",
"status": "ok",
"class": "2",
"nonce": "b8e1c07d9a42",
"session": { "token": "4f1d…c09e" },
"vars": { "motd": "Welcome back!" }
}Integration
One HTTPS request per login. Send your API key, a device ID and the customer's key. The reply is plain text: the key's class.
curl -X POST \
https://auth.OpenAuth.gg/index.php/ \
-d "apikey=YOUR_API_KEY" \
-d "hwid=DEVICE_ID" \
-d "lkey=CUSTOMER_TOKEN"import requests
reply = requests.post(
"https://auth.OpenAuth.gg/index.php/",
data={
"apikey": "YOUR_API_KEY",
"hwid": get_hwid(),
"lkey": token,
},
timeout=10,
).text.strip()
if reply in {"1", "2"}: # the classes you hand out
print(f"Signed in with class {reply}")
else:
print(f"Login rejected: {reply}")const string ApiUrl = "https://auth.OpenAuth.gg/index.php/";
using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(10) };
var form = new FormUrlEncodedContent(new Dictionary<string, string>
{
["apikey"] = "YOUR_API_KEY",
["hwid"] = GetHwid(),
["lkey"] = token,
});
var response = await http.PostAsync(ApiUrl, form);
var reply = (await response.Content.ReadAsStringAsync()).Trim();
Console.WriteLine(reply is "1" or "2"
? $"Signed in with class {reply}"
: $"Login rejected: {reply}");// Node 18 or newer, saved as login.mjs
const API_URL = "https://auth.OpenAuth.gg/index.php/";
const response = await fetch(API_URL, {
method: "POST",
body: new URLSearchParams({
apikey: "YOUR_API_KEY",
hwid: getHwid(),
lkey: token,
}),
signal: AbortSignal.timeout(10_000),
});
const reply = (await response.text()).trim();
console.log(["1", "2"].includes(reply)
? `Signed in with class ${reply}`
: `Login rejected: ${reply}`);token is the key your customer entered. The HWID helper stands for your own function that returns a stable device ID.
Pricing
Plans apply per application, so each product gets exactly the plan it needs.
For trying OpenAuth and small projects.
Free
Start freeFor products that are growing.
€5.99/month
Choose LiteEvery protection OpenAuth offers.
€12.99/month
Choose PremiumFAQ
Can't find what you need? The docs cover every setting, and the team is on Discord.
With offline licensing turned on, a successful login gives the device a signed lease. Your software keeps working until the window you set runs out, anywhere from 20 minutes to 90 days, and renews the lease in the background once it's back online. Without it, treat a network error as a failed login.
Your software sends a device ID with every login. The first successful login binds the key to that device, and logins from any other device are refused with hwid. When a customer changes computer, reset the binding from the dashboard. IP locking works the same way with IP addresses.
Yes. Export your keys from KeyAuth or auth.gg (or any spreadsheet) and upload the file under Control Panel > Import tokens. Classes, expiry dates and notes come along, and customers keep their existing keys. Importing is part of Lite and Premium.
No. The API key ships inside your software and can only check tokens, so it's fine if customers find it. Your secret key is the one to protect: keep it on your own server and never put it in software you distribute.
Any language that can make an HTTPS request, including C#, C++, Python, Node.js, Go, Rust and PHP. There's no SDK to install: a login is one POST request with a plain-text reply.
Create a free application in a minute. Upgrade to Premium when you want device locking, offline licensing and the rest.