Licence keys for your software
Issue keys, lock each one to a single machine and keep checking it while your app runs Revoke a key and the program closes on that PC within a minute
- Free, every feature
- SDKs or plain REST
- AES-256 + HMAC on every call
- One key, one machine
Dashboard
- C#
- VB.NET
- Python
- C++
- Node.js
- Java
- Kotlin
- Android
- PHP
- Dart
One key, from sale to shutdown
-
Sold
You create a key in the panel for 30 days, a year or for life, and send it to the customer
-
First sign-in
The customer types the key It locks to the hardware ID of that PC Any other PC is refused
-
Running
While the app is open it checks in every 30 seconds Every answer is encrypted and signed
-
Revoked
Refund, chargeback or a key posted in a group You revoke it in the panel
-
Closed
The next check-in is refused Your app gets the session-ended event and closes itself
One sign-in, five checks
What happens between the customer typing their key and your app opening If any check fails, the app stays closed
Types the key, the SDK adds the machine ID
PWF-8K3D-7HZE-XW4N-
01
Fresh, untouched request
PassIf not Older than 5 minutes or changed on the way: rejected
-
02
Real, unexpired key
PassIf not Wrong guesses in a row lock the sender out
-
03
Same PC as before
PassIf not Refused A reset needs your OK
-
04
Not shared around
PassIf not You get an alert on Telegram and can revoke it
-
05
A build you still allow
PassIf not Told to update before it can go on
Only after the SDK checks the signature A fake server gets nowhere
Signature verifiedThen every 30 seconds
The app checks in Revoke the key and it closes within a minute
Three missed check-ins
If the server can't be reached three times in a row, the app closes
Trials and texts
One trial per PC, and the texts, links and versions your app shows come from the panel
Five lines, and what they do
The code on the left, what happens when your customer runs it on the right No SDK for your language? Call the REST API from anything that speaks HTTPS
var client = new PwfClient(AppSecret);
client.SessionEnded += (s, e) => Application.Exit();
PwfResponse login = await client.LoginAsync(licenseKey);
if (!login.Success) { ShowError(login.Message); return; }
client.StartHeartbeat();
Public Shared Client As New PwfClient(AppSecret)
AddHandler Client.SessionEnded, Sub(s, e) Application.Exit()
Dim login = Await Client.LoginAsync(licenseKey)
If Not login.Success Then ShowError(login.Message) : Return
Client.StartHeartbeat()
client = PwfClient(APP_SECRET)
client.on_session_ended = lambda code, msg: os._exit(0)
res = client.login(license_key)
if not res.success: raise SystemExit(res.message)
client.start_heartbeat()
PwfClient client(appSecret);
client.SetSessionEndedCallback([](auto& code, auto& msg) { PostQuitMessage(0); });
PwfResponse login = client.Login(licenseKey);
if (!login.Success()) { ShowError(login.Message()); return; }
client.StartHeartbeat();
POST https://pwfauth.com/api/auth/login.php
X-App-Secret: 3f9a6c0e…b71d2c21e
X-PWF-Nonce: 7c41d0a9…5e3f09be
{"p": "q9Xc0vU1mJ8yR2…kZ7T==", "t": 1760112000, "s": "9f2c41e7…a6e1"}
HTTP/1.1 200 OK
X-PWF-Signature: kD3mVx0q…Q9wE8A==
-
14:02:11
Signed in line 4
Key PWF-8K3D-… is valid for 29 more days, now locked to this PC
-
14:02:41
Check-in line 7
Every 30 seconds while the app is open · 48 ms
-
14:03:11
Check-in
48 ms
-
14:03:41
Session ended line 2
You revoked the key in the panel The app closed itself
-
14:02:11
Request sent line 4
The body is encrypted with AES-256, with a timestamp and an HMAC
-
14:02:11
Signed reply line 7
200 OK Check the RSA signature before you trust it
-
14:02:41
Heartbeat
POST /api/auth/heartbeat.php every 30 seconds
-
14:03:41
Session ended
You revoked the key, so the next heartbeat is refused Close the app
$0 forever
Every feature, for every developer No card, no trial that runs out, and no feature kept for a paid plan
- Licence keys Hours to lifetime, locked to a PC
- Live kill switch Ban a key, the app closes
- Customer accounts Username and password sign-in
- Resellers and stores SellAuth, Stripe, Shoppex
- Updates Ship builds, make one required
- Texts and slides No new build to change them
- Telegram and Discord A bot for every app
- SDKs and REST API C#, VB.NET, Python, Node.js, C++
- Signed webhooks Your server hears every sale
- Applications
- No limit
- Resellers
- No limit
- PCs per key
- 100
- Update storage
- 2 GB
- Keys per batch
- 50
- Keys per import
- 5,000
Watch it work
Walkthroughs and tutorials from our YouTube channel, newest first
Questions
What is PWF Auth?
A licence server for software you sell You make keys in the panel, your app signs in with the key the customer typed, and the server keeps checking it while the app runs
Which languages are supported?
C# and VB.NET through the PWFAuth NuGet package (netstandard2.0, so .NET Framework 4.6.2+ and .NET 6+ both work), Python through the pwfauth package, and C++ with two source files that use WinHTTP and BCrypt from Windows Node.js through the pwfauth package on npm For Java, Kotlin, Android, PHP, Dart and Delphi, the SDK generator in your panel writes a ready client file for your app, and any other language can call the API directly
Can one key run on two computers?
Not unless you allow it A key locks to the first PC; you can let a key run on more PCs (up to 100) in the panel A customer who changes PC asks for a reset from inside your app and you approve it
What if my customer loses internet?
The app keeps running through three missed check-ins and then closes A short drop won't throw anyone out, and pulling the cable won't keep a revoked key alive
Can someone fake the server?
No Every reply is signed with PWF Auth's private key and the SDK checks it with the public key built into it, so a fake or changed answer is rejected before your app reads it
How much does it cost?
Nothing PWF Auth is free: licence keys, customer accounts, resellers, updates, texts and slides and the Telegram bot are all on the free account Create an account and add your first app in a few minutes




