A licence client for any language: Java, Kotlin, PHP, Dart, Delphi and more

PWF Auth has official packages for C# and VB.NET, Python, Node.js and C++. But plenty of paid software is written in something else: a Java tool, a Flutter app in Dart, a Delphi program that has sold well for fifteen years. For those, the SDK generator in your panel writes a ready licence client in one file, in your language, already set up for your app

The languages

C#, VB.NET, Python, JavaScript (Node.js), Java, Kotlin, Android, PHP, Dart, C++ and Delphi. Pick one, pick your app, and download the file. The end of every file shows how to use it

What the file can do

• Login and CheckKey: sign in with a licence key (which binds it to the PC), or only look a key up
• Heartbeat and RunHeartbeat: keep the session alive. RunHeartbeat loops and calls you back when the key is banned, paused, expired, reset or signed out from the panel: close your app there
• Logout: end the session
• RegisterAccount, LoginAccount, ChangeAccountPassword: customer accounts with a username and a password
• GetAppInfo, GetTexts, GetSlides: your app's name, version and links, and your remote texts and slides
• CheckUpdate: ask for a newer build
• CreateTrial and RequestHwidReset: a free trial for this PC, and a request to move a key to a new one

The names follow each language: LoginAsync in C# and VB.NET, login in Java and JavaScript, login and get_app_info in Python, Login and StartHeartbeat in Delphi

Delphi

Delphi 10.2 Tokyo or newer on Windows needs nothing extra. The file is the unit PWFLicense.pas: HTTPS comes from Windows through System.Net.HttpClient, and AES from Windows' bcrypt.dll. Every function returns a TJSONObject that you free, and StartHeartbeat runs on its own thread and calls you back once when the session ends

Android

Android 8.0 or newer has its own Kotlin file, made and tested for phones. It uses Android's own HttpURLConnection and names the phone by its ANDROID_ID, hashed with your app's package, so the same phone keeps the same id after a reinstall. The full walk-through, with a demo app on GitHub, is in the Android guide

Keep the secret safe

The file contains your app secret, so treat it like a password: keep it inside your compiled or obfuscated program, never in a public repository, a web page or a browser extension. Turn on the environment switch and the file reads the PWF_APP_SECRET environment variable instead, holding no secret at all: that's the way for open-source code and build servers. If a secret ever leaks, make a new one in Applications and generate the file again

How it talks to the server

Every request and reply is encrypted with AES-256 and signed with HMAC-SHA256, both keyed from your app secret, and a reply older than five minutes is refused. When a network blocks the name pwfauth.com and the app gets no reply at all, the same request goes to pwfauth.net, the same server

Using C# or VB.NET? The NuGet package is the easier way: fixes reach you as package updates, and it also checks that every reply was signed by PWF Auth's server

The full guide is in SDK generator