Core concepts

The objects you will be working with, and how they relate.

The object graph

Ownership

User (admin or seller)
└── Application            secret, key mask, hardware and session policy
    ├── Reseller access    one existing seller, scoped key permissions
    ├── Release            a version number, one active at a time
    │   └── File           addressed by a JSON key: core, driver, config
    ├── License key        level, expiry, device and use limits
    │   └── Device         a bound hardware id
    ├── Session            one live client connection
    ├── Variable           encrypted string handed to authenticated clients
    ├── Blacklist entry    an IP or hardware id to refuse
    └── Activity log       what clients did

Application

The unit of isolation. It owns a public id and a 32 byte secret, and every key, release, file and log belongs to exactly one application. Keys are not shared between applications: the same string in two applications is two unrelated keys. A seller sees applications they own plus applications where the owner gave them an active, key-only reseller assignment.

Release and file

A release is a version number plus one or more files. Exactly one release is active, and only the active one is ever delivered. Each file carries a JSON key you choose, and that key is your client's contract. See releases and files.

License key and level

A key has a level, a number from 1 to 255. Releases and variables each declare a minimum level, so level is how you build tiers: level 1 gets the basic bundle, level 3 also gets the premium module. A key also carries an expiry, a device limit and an optional login budget.

Session

Created by init, authenticated by login, kept alive by validate. Because validate re-checks the key, banning a key takes effect on the next heartbeat rather than at the next restart. The concurrent session cap is what stops a customer sharing one key across several machines at once.

Two different things called version

Client version (applications.version) is the build string your loader reports. When version enforcement is on, a mismatch is refused with VERSION_MISMATCH.

Release version is the label on a bundle of files. It has nothing to do with the client build and is never checked against it. Do not conflate the two.

Roles

Role	Can do
Seller	Manage every part of applications they own. A per-application reseller assignment can additionally grant scoped key work, but never settings, SDK or file access.
Administrator	Everything a seller can, plus every application on the installation, seller management and the audit trail.

The first account created on a fresh installation is automatically an administrator. See application resellers for the delegated key permission model.