Changelog

Publishing an app update whose ZIP contained a Windows executable (.exe / .dll) could fail — either with a generic "Server returned invalid response", or with "ZIP contains blocked file type".

Two separate causes, both fixed:

• Firewall false positive — our edge firewall content-inspects request bodies and was blocking API uploads that carried real binaries. API endpoints are now excluded from that inspection.


• Over-strict ZIP validation — the server-side check rejected any archive containing .exe, .dll or client script files. Update packages are stored and delivered to your users exactly as uploaded — never executed on our servers — so the check now only blocks server-executable scripts (.php and friends), which is the actual threat it was built for.

Verified end-to-end: a real update ZIP with an .exe payload now publishes and reaches devices normally.

Thanks to the developer who reported it — diagnosed, fixed and verified the same day. If an update upload ever fails for you, open a ticket and include the exact error text.

PWF Auth now has an official YouTube channel — and the first video is live: a 30-second teaser that walks the whole flow, from create your app to automate everything.

▶ Watch: How PWF Auth works — in 30 seconds

What's coming to the channel:

• Quick-start tutorials — protect your app in minutes


• SDK integration guides — C# / VB.NET (NuGet), Python (PyPI), Node.js (npm)


• Feature walkthroughs — heartbeat & kill switch, free trials, webhooks, OTA updates

Subscribe to @pwfauth so the next tutorial lands in your feed.

The public site now speaks Türkçe 🇹🇷 and 简体中文 🇨🇳 — bringing it to 7 languages (English, العربية, Deutsch, Nederlands, Português, Türkçe, 简体中文).

What's translated

• The full homepage — features, pricing, license models, FAQ


• The complete API reference


• Sign-up, sign-in, password reset & 2FA screens


• The blog, navigation and footer

How it works

• Your browser's language is detected automatically on first visit


• Or pick a language any time from the switcher in the navbar


• Direct links: pwfauth.com/?lang=tr · pwfauth.com/?lang=zh

The developer panel itself stays in English for now. If you'd like another language on the site, tell us — this wave took one day to ship.

A single license key can now be activated on multiple distinct devices — up to the key's Max Devices limit (1–100).

Previously a key bound to the first machine that activated it, and any other device was rejected with HWID_MISMATCH before the Max Devices limit was ever applied. That legacy single-HWID check is gone.

What's new

• One key works on up to Max Devices different machines


• Each device gets its own concurrent session — signing in on one never signs out the others


• Re-activating a machine that is already bound does not use an extra slot


• A new DEVICE_LIMIT response (with devices_used and max_devices) when every slot is full

In the panel

Open any key and choose Devices to see every bound machine — last IP, first and last seen — and unbind a single one to free a slot, without resetting the whole key.

Existing keys

Every already-activated license was migrated automatically: its current device is kept and its history stays intact. Just raise Max Devices to allow more machines. Keys set to Max Devices = 1 are unchanged and still return HWID_MISMATCH for a second device.

You can now sign in and create your account with a single click using Continue with Google — no extra password to manage. Two-factor stays enforced wherever it's enabled.

Link your Telegram account and sign in with a single tap using the official Telegram Login Widget — fast, secure, and passwordless.

App Updates now support stable/beta/alpha channels, staged % rollouts, OS/arch filtering, min-version gates, SHA-256 integrity hashes, mandatory-after timestamps, and a public /releases.php timeline.