00Feature index
Every feature, and the plan it's on
The whole of OpenAuth on one page. Base is free for 10,000 logins a month; Lite is €5.99 and Premium €12.99 a month, per application. Each feature links to its guide.
No feature matches that. Try another word, or .
Licensing
Keys, tiers and how customers sign in.
- BaseGuide: generating tokens
Bulk license keys
Generate up to 1,000 keys a batch, then copy or download them straight away.
- LiteGuide: generating tokens
Custom keys
Your own text as the key, such as
STUDIO-2026-LIFETIME. - PremiumGuide: managing tokens
Expiring keys
Give keys an expiry date, and extend or shorten it later. Expired keys are refused on every plan.
- BaseGuide: managing tokens
Freezing and notes
Freeze a key without deleting it, and keep a note on each one, such as the order it came from.
- LiteGuide: managing tokens
Deleting keys
Remove keys for good, one at a time or in bulk.
- BaseGuide: token classes
Named classes and features
Name each tier, give it a colour and up to 50 features your software checks, such as
export. - BaseGuide: token classes
Class selectors
Target tiers with
2,1-3,4+,*or a class name in rules, variables, reseller limits and the API. - BaseGuide: token classes
Changing a key's class
Move a customer up or down a tier. Their bindings, expiry and devices stay as they are.
- PremiumGuide: token classes
Class defaults
A default duration and an offline device limit for each class.
- LiteGuide: importing tokens
Import from KeyAuth, auth.gg or CSV
Bring your existing keys over. Classes, expiry dates and notes come along, and customers keep their keys.
- BaseGuide: sign-in methods
License keys or user accounts
Customers type a key, or sign in with a username and password.
- BaseGuide: sign-in methods
Customer portal
Account customers redeem keys, download your files and move their own device at
user.openauth.gg.
Protection
The checks that stop sharing, cracked builds and region dodging.
- BaseGuide: authentication endpoint
Frozen and expired keys refused
Enforced on every plan, on both APIs and for offline leases.
- PremiumGuide: HWID and IP locking
HWID locking
The first login binds a key to that device, and logins from any other device get
hwid. - PremiumGuide: HWID and IP locking
IP locking
The same, for networks. Addresses come from the connection or Cloudflare, never from headers a client can fake.
- PremiumGuide: HWID and IP locking
Reset cooldowns
Customers move their own device from the portal or your bot, no more often than the hours you set.
- PremiumGuide: access rules
Access rules
Block, restrict or bypass logins by country, class, HWID or IP.
- PremiumGuide: block lists, allow lists and VPN blocking
VPN and proxy blocking
Turn away logins from known VPNs, proxies and hosting providers.
- PremiumGuide: block lists, allow lists and VPN blocking
Block and allow lists
Ban specific devices, networks and builds, or let trusted ones straight through.
- PremiumGuide: release checks
Release checks
Enforce version, build ID and file signature, so old and modified copies can't sign in.
- PremiumGuide: custom responses
Custom responses
Replace the class number with your own hard-to-guess success value.
- PremiumGuide: insights and sharing detection
Sharing detection
Flags keys seen from too many IP addresses or countries in 24 hours, and can freeze them for you.
Signed API
Replies your software can verify, and config that travels inside them.
- BaseGuide: signed API
ES256-signed replies
Every reply is a JWS signed with your application's key, so a fake server can't produce a valid answer.
- BaseGuide: signed API
One-time nonces
Each reply echoes your request's nonce and expires after five minutes, so recorded replies can't be replayed.
- BaseGuide: signed API
Sessions and heartbeats
Sessions from 5 minutes to 24 hours. Every heartbeat re-checks the license and rotates the session token.
- BaseGuide: reply encryption
Reply encryption
Base64, an app key (AES-256-GCM) or a per-request key (ECDH-ES), so a debugging proxy sees ciphertext only.
- BaseGuide: variables
Variables
Links, messages and settings in the signed reply, for every class or only some: plain, Base64, or encrypted with a key only your software has.
- BaseGuide: authentication endpoint
Original endpoint, plain text or JSON
One POST with a reply that's the key's class or the reason it failed. Keeps working alongside the signed API.
Offline licensing
Signed, device-bound leases for software that can't always reach the internet.
- PremiumGuide: offline licensing
Offline leases
A signed lease bound to one device, valid from 20 minutes to 90 days without a connection.
- PremiumGuide: offline licensing
Background renewal
Leases renew from 10% to 90% of the way through the window, and every renewal re-checks the license.
- PremiumGuide: offline licensing
Devices per key
Allow 1 to 100 devices per key, with a different limit for each class if you like.
- PremiumGuide: offline licensing
Installations
See every activated device in the dashboard and revoke the ones you no longer trust.
- PremiumGuide: offline licensing
Clock protection
The SDKs detect a clock set backwards, and a runtime budget ends a lease even if the clock is frozen.
Releases and files
Updates and downloads that only reach licensed customers.
- BaseGuide: update channels
Update channels
Releases on channels such as
stableandbeta, with notes, a mandatory flag and rollback. - BaseGuide: linking a GitHub repository
GitHub releases
Link a public or private repository and import its releases, or each commit that changes a build file.
- BaseGuide: update channels
Stored copies of release files
Keep release files on OpenAuth, or send customers to GitHub. 10 MB each, or 100 MB on Premium.
- LiteGuide: management API
releases.syncfrom CITell OpenAuth about a new release straight from your build pipeline.
- BaseGuide: delivering files
Files behind the login
Stream program files only after a successful login, or offer them in the portal. 3 files of 10 MB, or 6 of 100 MB on Premium.
- BaseGuide: virus scanning
VirusTotal scanning
Uploads wait in quarantine until they're checked. PUA, HackTool, GameHack and Packed labels don't count towards holding a file.
- BaseGuide: SDKs
Verified update downloads
The SDKs download an update after a license check and verify its signed size and SHA-256.
SDKs and integrations
Ways in from your software, your server and your community.
- BaseGuide: SDKs
Python SDK
One file,
openauth.py. Python 3.8 or newer with thecryptographypackage. - BaseGuide: SDKs
C# SDK
One file,
OpenAuth.cs. .NET 8 or newer, no NuGet packages. - BaseGuide: authentication endpoint
Any language over HTTPS
No SDK needed: C++, Go, Rust, PHP, Node.js or anything else that can make a POST request.
- LiteGuide: management API
Management API
Create and look up keys, reset devices and publish releases from your server, with keys scoped to what they need.
- LiteGuide: Discord bot
Discord bot
An example bot that lets staff manage keys and customers move their own license.
- PremiumGuide: login webhooks
Login webhooks
A Discord message for every login attempt, with the reason when one fails.
- PremiumGuide: XenForo
XenForo add-on
Members activate their forum account with a key, reset their device and download your files from your forum.
Team and insights
Who can change what, and what's happening with your logins.
- BaseGuide: team members and roles
Team roles
Invite Support, Moderator, Administrator and Manager members, each with the access their role allows.
- BaseGuide: team members and roles
Ownership transfer
Hand an application to an Administrator or Manager. Both of you confirm with your password.
- BaseGuide: team members and roles
Activity log
What every member and API key changed, and when.
- PremiumGuide: team members and roles
Team messages
A shared chat for everyone who runs the application.
- PremiumGuide: resellers
Resellers
Partners generate and manage their own keys, within the allowance, classes and durations you set.
- BaseGuide: insights
Insights
Every login, activation and download with its result and country. 14 days of history, 30 on Lite, 90 on Premium.
Start free, upgrade per app
Every application starts on Base. Move one to Lite or Premium when it needs more, and keep the rest free.