KeyAuth
Sign in

Introduction

KeyAuth is a self hosted licensing server. You keep your payload on the server, hand customers a key, and the client receives what it needs only after that key checks out.

What it does

A normal licensing check asks the server “is this key valid?” and trusts the answer. That answer is a single boolean, which is exactly what a patcher looks for. KeyAuth is built the other way around: the client ships with nothing useful in it. The DLL, driver or asset that makes your tool work lives on this server and is only handed over after a key authenticates.

Removing the check does not unlock the product, because there is nothing there to unlock.

What you get

  • Multiple applications under one account, each with its own secret, key format and policy.
  • License keys generated from a mask you design, such as SIMP-XXXX-XXXX-XXXX.
  • Releases: versioned bundles of files, each addressed by a JSON key your client reads.
  • Hardware locking, device limits, concurrent session caps and login budgets.
  • Encrypted variables for endpoints and tokens you do not want compiled into a binary.
  • IP and hardware blacklists evaluated on every authenticated request.
  • A C++ SDK generated per application that links only against Windows system libraries.
  • An activity log and an administrator audit trail.

How the traffic looks

Every call is a POST to a single endpoint, and everything meaningful is inside an AES-256-GCM sealed envelope. The action name is part of the ciphertext, so someone watching the connection cannot tell a login from a heartbeat, let alone read a key.

Every request looks like this on the wire 
POST /api/v1/gateway

{
  "v":   1,
  "app": "8717bb90b751bb948c630e85ee0d42ac",
  "sid": "5f2a0c4e8d1b7a9036c5e4f1a2b8d7c3",
  "ts":  1774521600,
  "n":   "3f9c1a7e5b2d8046c1e7a9f4",
  "iv":  "b71e4d0a92c5f836a4d70e19",
  "ct":  "hQ2+Xr9…",
  "tag": "9c4a7f18e0b52d6a3f8c1e94d7205ba6",
  "sig": "1f7c…a93e"
}

Encryption keys are derived per message with HKDF and are never transmitted. Both sides compute the same key from the application secret. See the KA1 protocol for the exact construction.

Where to go next