Documentation

How SAUTH works

The concepts you need before integrating SAUTH into your software.

Core concepts

Concept	What it is
Organization	Your account's tenant. Owns applications and team members. Data is isolated per organization in the database.
Application	One piece of software you distribute. Has a public id, a signing key pair and its own licenses, users, variables and files.
License	A key that grants access: lifetime, subscription (time-limited from activation) or trial. States: unused, active, expired, revoked, suspended.
Customer	An end user of your application. Signs in through your software, never through the SAUTH dashboard.
Subscription tier	A level your application defines (e.g. Basic = 1, Premium = 2). Licenses grant tiers; variables, files and chatrooms can require one.
Session	Created when your app initializes. Becomes authenticated after a login or license check and stays valid through heartbeats.

SAUTH assumes your shipped binary will be reverse-engineered. Its design follows from that:

Your app embeds only its public application id and the public half of its Ed25519 signing key. There is no client secret.
The server signs every response. SDKs refuse responses whose signature does not verify, which defeats fake local auth servers and tampered traffic.
Requests carry a timestamp and single-use nonce, so captured requests cannot be replayed.
License status, expiry, device policy, bans and tiers are evaluated by the server on every request. Never gate features on a value your client computed itself.
Hardware IDs come from the client and can be spoofed. Use HWID locking to discourage key sharing, not as proof of identity.

Init — the SDK opens a session with your application id and version. Disabled apps, blocked versions and failed hash checks stop here.
Authenticate — license key, username and password, or token. The server checks the credential and every policy attached to it.
Use — read variables, download files and send heartbeats with the session token.
End — logout, expiry, or revocation from the dashboard ends the session on its next request.