License keys
Single or bulk generation with your own key format, lifetime, subscription and trial types.
Server-authoritative licensing for desktop & game software
Licensing your software can actually trust.
Issue license keys, authenticate users, bind devices and ship updates. Every check runs on the server, where it can't be patched out of your binary.
client ⇄ api.sauth — license check
// Your app sends the key and a device fingerprintPOST /v1/auth/license{ "key": "SAUTH-7Q2KD-M4XNP-R8C1V-ZT6HB", "hwid": "b41f…9e2c" }// The server decides — and signs the answer200 OK signature: ed25519 ✓{ "status": "ACTIVE", "tier": "Premium", "expiresAt": "2027-11-01" }How it works
One request. Five checks. A signed answer.
The client only asks. Every decision is made and signed by the server, so patching a jump instruction gets an attacker nothing.
Step 1
Initialize
Your app opens a session with its public application id and version. Nothing secret ships in the binary.
- ✓ Application enabled
- ✓ Version allowed
- ✓ Binary hash
Step 2
Screen the request
Timestamp and nonce defeat replays. IP, ASN and device blocklists are applied before any credential is read.
- ✓ Replay protection
- ✓ Rate limits
- ✓ Blocklists
Step 3
Authenticate
License key, username and password, or token. The server checks status, expiry, device policy and subscription tier.
- ✓ License state
- ✓ Device policy
- ✓ Subscription
Step 4
Sign the verdict
Every response is signed with your application’s Ed25519 key. The SDK rejects anything it cannot verify.
- ✓ Ed25519 signature
- ✓ Bound to session
Step 5
Stay validated
Heartbeats keep the session honest. Revoke a key or ban a user and the next heartbeat ends the session.
- ✓ Heartbeat
- ✓ Instant revocation
Everything in one place
The whole licensing stack, not just key checks
Licenses, users, devices, files, updates and team workflows — isolated per application and per organization.
Subscriptions
Tiers your application defines, granted by keys and enforced on every request.
Resellers & Seller API
Let partners generate keys from a credit balance, with scoped server-side keys.
Customer accounts
Username/password, license-only or token login for your end users.
HWID binding
Single- or multi-device policies with self-service or approved resets.
Sessions
See every active session and end any of them instantly.
Variables
Global, application and per-user values, encrypted at rest.
Protected files
Versioned downloads served through short-lived signed URLs.
Versions & updates
Force updates, block versions and verify binary hashes.
Developer experience
A few lines in your app. The rest is ours.
Initialize with your public application id, call one method, and read a verified result. SDKs handle signatures, nonces, retries and sessions.
- No client secret to extract — only a public id and public key ship
- Every response signature-verified before your code sees it
- Typed errors with stable codes you can branch on
- C++, C#, Python and JavaScript / Node.js
main.cpp
#include <sauth/sauth.hpp>
int main() {
sauth::Client app{"app_9f3k2m", "1.4.0", SAUTH_PUBLIC_KEY};
app.init();
auto result = app.license(read_key_from_user());
if (!result.ok()) {
std::cerr << result.message() << '\n';
return 1;
}
std::cout << "Welcome, tier " << result.tier() << '\n';
}Preview of the SDK interface. SDKs are published alongside the public authentication API.
Security model
Assume the binary is already cracked
Anything in a shipped client can be read and patched. SAUTH is designed around that fact instead of hoping obfuscation holds.
The server is the authority
License state, expiry, device policy, bans and tiers are decided server-side on every request. Clients only display the result.
Signed responses
Responses are signed per application with Ed25519. A fake local auth server or a tampered response fails verification.
Replay protection
Requests carry a timestamp and single-use nonce. Recorded traffic cannot be played back.
Isolation in the database
PostgreSQL row-level security and integrity triggers keep each organization’s data separate even if application code has a bug.
Secrets stay secret
Argon2id for passwords, keyed hashes for tokens and HWIDs, AES-256-GCM for license keys, TOTP seeds and signing keys.
Honest about HWIDs
Hardware IDs are client-supplied, so we treat them as a sharing deterrent — never as proof of identity.
No licensing system makes software uncrackable, and we won't claim otherwise. SAUTH makes cracking expensive, keeps entitlements under your control, and lets you revoke access the moment abuse appears.
REST API
Automate everything you can click
Generate keys from your store, sync customers from your backend, or build your own tooling. The dashboard uses the same API.
Request
POST /api/v1/applications/{id}/licenses
Authorization: Bearer sk_live_••••
Idempotency-Key: order-10482
{
"type": "SUBSCRIPTION",
"durationDays": 30,
"tier": "Premium",
"quantity": 25,
"format": "PRO-*****-*****-*****"
}Response201 Created
{
"batchId": "0193a6c2-…",
"count": 25,
"keys": [
"PRO-K7Q2D-M4XNP-R8C1V",
"PRO-ZT6HB-9WQ3L-2FJ8A",
"…"
]
}X-Request-Id: 9b1d1e5e-4c2a-4f0e-8a51-3c7c1a7d2f60
Versioned
Breaking changes ship as a new version. /v1 keeps working.
Stable error codes
Branch on LICENSE_EXPIRED, not on message strings.
Request IDs
Every response and error carries one for tracing.
Idempotent writes
Retry key generation safely with Idempotency-Key.
Pricing
Start small, scale when you sell
Every plan includes the full security model. Limits grow with your business.
Free
Default plan for new organizations. Adjust limits in the admin panel.
Free
- 1 application
- 100 licenses
- 100 end users
- 1 team member
- 50 MB file storage
- 100,000 API requests / month
- 7-day log retention
FAQ
Questions developers ask us
Stop shipping your license logic inside your binary
Move entitlement decisions to a server you control, and keep the controls in one dashboard.