Applications

Identity and availability

Setting	What it does
Status	Active serves normally. Maintenance refuses with APP_PAUSED. Disabled refuses with APP_DISABLED.
Message shown to clients	Returned over the encrypted channel when paused or disabled, so your loader can display a reason.
Client version	The build string your loader reports.
Reject stale client versions	When on, a mismatch is refused with VERSION_MISMATCH.
Update URL and message	Sent alongside VERSION_MISMATCH so the loader can self update.

Sessions and rate limits

Setting	What it does
Concurrent sessions per key	The main anti sharing control. 1 means one machine at a time. 0 disables the check.
When the limit is reached	Either refuse the new session, or close the oldest one. Closing the oldest is friendlier for customers who crash a lot.
Session lifetime	Seconds, refreshed on every heartbeat. Shorter means a ban bites sooner.
Clock tolerance	How far a client clock may drift before CLOCK_SKEW. Do not widen this to paper over a broken clock.
Requests per minute per IP	Coarse abuse protection. Failed logins have their own stricter counter.
Accept client log messages	Lets clients write into your activity log.
Allow client initiated bans	Off by default, and it should stay off. A tampered client can ban its own key.

File delivery and transport

Setting	What it does
Chunk size	Bytes per encrypted chunk, applied to future uploads only.
Inline delivery limit	Files at or below this ride along with the login response. See releases.
Encrypt stored files	Leave on. Each chunk gets its own tag bound to its index.
Server public key pin	SHA-256 of the SubjectPublicKeyInfo, 64 hex characters. The SDK then refuses any other certificate. Requires HTTPS.

Danger zone

Rotate the application secret when a binary leaks. Every existing build stops authenticating immediately, so you must ship a rebuilt loader at the same time. Both this and deletion require typing the application name, because neither can be undone.

Deleting an application removes its keys, devices, sessions, releases, files, variables, blacklist and logs.