Keys and masks

You design the shape of your keys. The mask decides what customers see and how hard a key is to guess.

Mask tokens

Tokens are replaced with random characters. Everything else is copied through literally.

Token	Replaced with
`X`	Uppercase letter or digit
`@`	Uppercase letter only
`#`	Digit only
`%`	Lowercase letter or digit
`?`	Character from the custom charset
`\X`	Backslash escapes the next character as a literal

Examples

SIMP-XXXX-XXXX-XXXX     ->  SIMP-V8H8-T4UC-6BW4
AUR-@@##-XXXX-XXXX      ->  AUR-KP47-9WZC-3TFH
HEL-XXXX-XXXX-XXXX-XXXX ->  HEL-8QMT-4RJD-2YCW-7KVN

Entropy, and why the server refuses weak masks

A mask with too few random positions can be brute forced. The dashboard shows the entropy of your mask and rejects anything below 40 bits. That is a deliberate floor, not a suggestion: KEY-## has about 6 bits and would fall to a script in seconds.

SIMP-XXXX-XXXX-XXXX with ambiguous characters dropped carries roughly 59 bits, which is comfortable. Add more X groups if you want more.

Ambiguous characters

Drop ambiguous characters removes O, 0, I, 1, l and L. Leave it on unless you have a reason. Customers retype keys by hand and by phone, and this single setting removes most support tickets about a key that “does not work”.

How keys are stored

No column holds a usable key. Each key is stored as an HMAC for lookup plus a separate ciphertext, and the tables only show a masked preview. Revealing a key is an explicit action that writes to the audit trail. Export the whole batch as CSV when you need the plaintext for delivery.

Expiry model

Setting	Effect
Duration 0	Lifetime key, never expires.
Start countdown on first login on	The clock starts when the customer first authenticates. Best for resale, because a key can sit unsold for months.
Start countdown on first login off	Expiry is fixed the moment the key is created.
Maximum logins	A hard budget of successful logins. 0 means unlimited.

Changing the mask does not touch existing keys. Old keys keep working in their old shape, so you can change format between batches without breaking anyone.