PWF Auth is the license-key, user-account, and OTA-update backend you'd build yourself — already built, documented, and behind one simple REST API.
See how it workscurl -X POST https://pwfauth.com/api/auth/check-key.php \
-H "X-App-Secret: $APP_SECRET" \
-d '{"license_key":"PWF-XXXX-XXXX-XXXX"}'
# → { "success": true, "valid": true,
# "key": { "expires_at": "...", ... } }Dim http As New HttpClient()
http.DefaultRequestHeaders.Add("X-App-Secret", APP_SECRET)
Dim res = Await http.PostAsync("https://pwfauth.com/api/auth/check-key.php",
New StringContent("{""license_key"":""PWF-XXXX-XXXX-XXXX""}"))
' → {"success":true,"valid":true,"key":{...}}var http = new HttpClient();
http.DefaultRequestHeaders.Add("X-App-Secret", APP_SECRET);
var res = await http.PostAsync("https://pwfauth.com/api/auth/check-key.php",
new StringContent("{\"license_key\":\"PWF-XXXX-XXXX-XXXX\"}"));
// → {"success":true,"valid":true,"key":{...}}$ch = curl_init('https://pwfauth.com/api/auth/check-key.php');
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ['X-App-Secret: ' . $APP_SECRET],
CURLOPT_POSTFIELDS => '{"license_key":"PWF-XXXX-XXXX-XXXX"}']);
$res = json_decode(curl_exec($ch), true);
// → ['success' => true, 'valid' => true, ...]One backend. Six core systems. Zero boilerplate.
Every dot is a country that has actually signed in — drawn from real login history. Green dots have a session running right now.
Generate, validate, revoke, and bulk-issue keys. Hardware-ID binding, expiry, trial mode, and quota built in.
Username/password auth with bcrypt, JWT sessions, password reset, 2FA, and brute-force protection.
Push new versions to your installed base. Channel-based rollouts, signed downloads, mandatory-update flag.
See who's online right now. Detect concurrent abuse, kick a session, or limit installs per license.
Ship one binary, gate features by plan. Toggle remotely without a redeploy. Per-user A/B testing.
Geo distribution, daily-active users, revenue charts, and a full audit log of every admin action.
Issue keys in any commercial model your app needs — all six below are shipped, working capabilities, not a roadmap.
Buy once, works forever. Keys with no expiry date for classic one-time purchases.
expires_at = null
Time-boxed keys with exact expiry dates — monthly, yearly, or any duration you define.
expires_at = <date>
Short-lived evaluation keys that expire on their own — no manual cleanup, no honor system.
duration = 7d
Keys bind to a machine fingerprint (HWID) with a device limit you choose — sharing stops working.
hwid + max_devices
Sessions renew by heartbeat, and a revoked key dies within minutes — a real kill-switch for leaks.
heartbeat · revoke
Toggle individual features per key from the dashboard — sell tiers and add-ons on one binary.
features: { … }
All six models ship in the free tier — there is no other tier.
You'll be calling the API faster than your linter finishes.
Sign up with an email — every feature unlocked, free forever, no credit card.
One click in the dashboard creates an app, your API key, and a JWT secret.
curl -X POST https://pwfauth.com/api/admin/keys.php \
-H "Authorization: Bearer $PWF_ADMIN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"app_id":"YOUR_APP_ID","count":50,
"key_type":"days","duration_value":30}'
# → { "success": true, "count": 50,
# "keys": [ { "license_key": "..." }, ... ] }curl -X POST https://pwfauth.com/api/auth/check-key.php \
-H "X-App-Secret: $APP_SECRET" \
-H "Content-Type: application/json" \
-d '{"license_key":"PWF-XXXX-XXXX-XXXX"}'
# → { "success": true, "valid": true,
# "key": { "expires_at": "...", ... } }Concrete outcomes from the real feature set — for desktop apps, game tools, SaaS, mobile companions, plugins and resellers — in your first week, on the free plan.
Drop the SDK into WPF, WinForms or Electron and replace hundreds of lines of homegrown auth — HWID binding included.
Watch every active session live, kick stolen copies in real time, and revoke a leaked license from your phone.
Every feature is free — unlimited keys, users and apps. Ship your whole launch without ever hitting a paywall.
Multi-tenant from day one: separate keys, users and updates per app, behind one dashboard and one account.
API responses are AES-encrypted and HMAC-signed, and 2FA is mandatory for every admin — the docs show exactly how to verify it.
Roll out patches over the air by channel — your users get them the next day, with no new-installer emails.
You could. Here's what rolling your own license + auth stack really costs — versus one REST call, free.
The anomaly detector flags multi-IP and cross-country use, and hardware binding stops the shared copy from running at all.
Generate and deliver keys from one API call, or let resellers issue from their own credit-based portal while you sleep.
Live sessions phone home, so you see versions in real time — push an OTA update or kill a key and it dies within minutes.
| Capability | Roll your own |  PWF Auth |
|---|---|---|
| Time to first license | Weeks of auth plumbing | One REST call — about 5 minutes |
| License keys, HWID, expiry | Design, build & debug it | Built in |
| Accounts, 2FA & sessions | Another few weeks of work | Included |
| OTA updates & remote kill-switch | You build & maintain it | Included |
| Security patches & uptime | Your responsibility, forever | We run and patch it |
| Price | Your time — the costly part | $0 — free forever |
| Price | Server, SSL, backups, patches — your money and your weekends | $0 · forever, every feature included |
PWF Auth is completely free — every feature, unlimited forever. No credit card, no trial, no upsell.
No purchased certificates on this wall — every badge below is a real, shipped mechanism you can test yourself.
SDK requests and responses travel in a signed, AES-encrypted envelope — not plain JSON on the wire.
Panel sign-ins are protected by time-based 2FA codes on top of the password.
Keys lock to a machine fingerprint (HWID) with a device limit you choose per key.
Repeated failed sign-ins lock out the address and the account automatically.
A detector flags impossible travel, IP spread and abnormal login rates per key.
Revoke a key and its live sessions die on the next heartbeat — within minutes.
Live world map of auth traffic with one-click IP blocking baked into the panel.
Public endpoints are rate-limited, so scripted abuse hits a wall before your data does.
Stop reinventing license management. Create your free account and call the API in five minutes.
Create your account and issue your first key in about five minutes.
Start free — foreverRead the full REST API and SDK docs first — every endpoint is public.
Open the API docsOpen a support ticket and a human answers — no account required.
Talk to us