Changelog

Texts and slides now say when they last changed

Your app now gets the time each text and slide was last changed, so it can show "Updated 1 Nov, 12:12" under a text or refresh only what is new, with no guessing

• Next to texts comes texts_updated, with the same keys and the time of each text: "welcome_message": "2026-11-01T09:12:30Z"
• Every slide has its own updated_at
• Both come in the sign-in reply and from GetTexts / GetSlides. Asking for one text by its name gives its updated_at too

The time moves when you save a text or a slide in the panel, or show or hide it. Moving a slide up or down keeps its time, and a key with its own value for a text gets the time of that value. Times are in UTC, like the rest of the API

Nothing your app reads today changed, so older builds keep working as they are

Texts & slides → Read them in your program

Discord bot: Redeem Key and Reset HWID buttons for your customers

Your customers no longer need to remember slash commands. Run /pwf panel in a channel of your Discord server and the bot posts a message with three buttons:

• Redeem Key opens a window for the key, then claims it for the customer's Discord account and gives the buyer role when you set one, like /redeem
• Reset HWID lists the keys they claimed: they pick one and it is free for a new PC, by your app's rules, like /resethwid. With no claimed key it opens the window instead
• My keys shows their keys and the time left, like /mykeys

Only the customer who pressed sees the answers, and wrong keys count toward the same pause as the commands

You write the panel: the title, the message and the name of each button, in your customers' language and with Discord markdown. Add color:#8B5CF6 for your own color, or leave My keys empty to hide that button. Run /pwf panel again in the same channel and the panel changes in place; in another channel it moves there. Unlinking the server removes it

The bot needs View Channel, Send Messages and Embed Links in that channel, and new invites ask for them. Without them the panel still shows up, as the answer to the command, but the bot can't edit it later

Discord bot → Customer panel

Watch the video on YouTube

Add-ons: extra content your customers unlock with an add-on key

An add-on is extra content the customer unlocks inside your program, while signed in with their own licence key or account: a map pack, a skin set, a Pro mode. You sell it with add-on keys. The customer types the key in a box you show and the add-on is theirs at once, with no second sign-in. An add-on key never signs in by itself

• In App settings → Add-ons, add one with a name, a code your program checks (like night_city) and how long its keys give it: for good or a number of days
• Make keys makes its keys in your app's key format. Its keys shows each key: unused, or who added it and when
• Your program calls redeemAddon(key). Sign-in and every heartbeat bring addons: the add-ons the customer has, each with its code and when it ends
• In Files, set Who gets it of a protected file to an add-on. Only customers who have it can fetch it, so a cracked program that flips the check still has nothing to load
• A second key of the same add-on adds its days on top. Switch an add-on off and its keys are refused, while customers who have it keep it
• Give or take an add-on by hand from the side panel of a key in Licences or of an account in Users
• Customers see their add-ons on the customer page and can add a key there too
• The webhook event addon.redeemed tells your server when a customer adds a key

SDKs: PWFAuth 1.8.0 on NuGet (RedeemAddonAsync, Addons, HasAddon, AddonsChanged) and pwfauth 1.6.0 on PyPI (redeem_addon, addons, has_addon, on_addons_changed). Both fetch protected files too. The SDK generator has redeemAddon and getAddons for all 11 languages

Applications → Add-ons

Watch the video on YouTube

App settings: everything about an app on one page

Click an app's card in Applications, or Settings on it, and everything about that app opens on one page. At the top: its logo, version, app ID and its numbers. Below, one tab for each part:

• General: logo, name and version, status, download link, seller, key format
• Messages: the welcome message and what customers read when something is refused
• Customers: free trial, customer accounts and sign-up, moving a key to a new PC
• Social links: your Discord, Telegram, YouTube or website, as buttons in your program
• Add-ons: extra content a customer unlocks with an add-on key
• Files: protected files
• Secret: the app secret and app ID, a new secret, deleting the app

Each tab has one Save changes. It wakes up when you change something, and leaving with unsaved changes asks first. Only the app's owner opens its settings; team members keep working on keys, accounts and sessions

Moved here: Edit and Messages from the app's card, Sign-up settings from Users, Self-service from HWID resets and Protected files from Leak tracer. Their old places link to the right tab

New on this page:

• A logo for each app (JPG, PNG, GIF or WebP up to 2 MB). It shows on the app's card, in its settings and on the customer page
• The seller name and contact your program gets in the seller block of every sign-in, like t.me/yourname
• PCs per trial and Trials per address, so one person cannot run trial after trial
• Social links: drag to change the order, a switch to hide one, and a click count when your program reports clicks

Applications → App settings

Customer portal: your customers can sign in with their account

Customers who use an account in your program (username and password) can now open the customer portal too. Until now it took only a licence key. They pick Account on the sign-in form and type the same username and password they use in your program

• See how long the account runs, or Lifetime
• Add a licence key of your app, and its time goes onto the account
• Move the account to a new PC, by your rules in HWID resets → Self-service
• See the copies running now and sign any of them out
• Change the password. Every copy still signed in with the old one is signed out, and on linked apps the new password works in all of them

They don't pick the app: every account of yours with that username and password opens, one tab for each app. Wrong passwords are counted for each username, so guessing is blocked even from many addresses. Keys and accounts can sit side by side in one browser

Users → The customer portal

Android: licence keys and a kill switch in your phone app

The SDK generator has a new Android tab. It writes one Kotlin file, made and tested for phones, with your server and your app already inside

• One key, one phone: every phone gets its own device id, made from Android's ID and your app's package, so it stays the same after a reinstall
• The kill switch: the app checks in every 30 seconds. Ban, pause or expire a key and the next check-in closes the app and tells the user why
• Keys or accounts: sign in with a licence key, or with a customer account (username and password)
• Encrypted and signed: every request is sealed with your app secret, like in every other SDK
• Nothing to add in Gradle: Android 8.0 or newer, only the internet permission in your manifest

The demo app is a complete Kotlin and Jetpack Compose project: clone it, put your app secret in local.properties and run it. pwfauth-android on GitHub

The video goes from a new app in the panel to a ban on a real phone, step by step. Watch it on YouTube

SDK generator

Team: let people help with your app, without your password

You can now invite other people to work on one of your apps. Each person signs in with their own PWF Auth account (their own password and two-step sign-in) and does only what you allow. Nobody needs your password any more

• Invite by email: open Team in the sidebar, pick the app, type their email and send. They get an email, a Telegram message when their account has Telegram, and accept it from their own Team page. No account yet? They make one for free with that address
• Four ready roles: Viewer sees keys, users, sessions and stats and changes nothing. Support also adds time, resets machines, answers HWID reset requests, bans and ends sessions. Manager also makes keys and accounts, edits them, and handles Updates and Texts & slides. Co-owner also deletes, downloads the lists and sets Rules. Or tick each permission yourself
• Per app: someone can be Support on one app and never see your other apps. Shared apps show on their pages with your name, like "Nova (Ahmad)"
• Always yours: deleting the app, its secret and the SDK generator, resellers and their credits, Developer API keys, webhooks, bots, stores, Freeze all and Revoke App, sign-up settings, the leak tracer and the team itself never go to a member, whatever you tick
• Daily limit: set the most keys and accounts a member can make in one day
• Activity: every change a member makes is listed in Team → Activity (who, what, which key, when), and stays there after you remove them
• Telegram alerts: you hear when someone joins or leaves, makes 20 or more keys at once, deletes or bans 10 within 10 minutes, or reaches their daily limit
• Remove takes them out at once: their next click on your app is refused

The server checks every permission on every action, so a hidden button is never the only lock. Up to 10 members and invitations per app. Docs: Team

User variables: values your program keeps on the server for each customer

Your program can now keep small values on the PWF Auth server for each customer: a setting, a theme, a counter, a flag, a saved state. They follow the customer to a new PC, and you can see and change every one of them in the panel. No server of your own needed.

• In your program, after sign-in: SetVariableAsync("theme", "dark"), GetVariableAsync("theme") (null when never set), GetVariablesAsync(), DeleteVariableAsync("seen_intro"). The Python package has set_variable, get_variable, get_variables and delete_variable. Any other client calls POST /api/auth/var.php with the session, the same encrypted envelope as the heartbeat.
• In the panel: open a key in Licences or an account in Users; the side panel has a Variables section with every name and value, when it last changed and who changed it. Change a value, remove one, or add one yourself, for example tier = vip, and the program reads it on its next start.
• From your own scripts: the Developer API reads and writes them too: GET /keys/{key}/vars, PUT /keys/{key}/vars/{name} with {"value": "…"}, DELETE /keys/{key}/vars/{name}. Your store or bot can set a value when an order is paid.

A variable belongs to one customer of one app: nobody else's program can read it. Each customer can have up to 50, each value up to 4 KB of text. Deleting the key or the account deletes its variables. A banned, paused or expired key gets nothing, as with texts. Docs: User variables.

Rules: block an address, a machine, a country, a network or VPNs

Decide who may not sign in to your app at all, before the key or the account is even looked at. Rules is a new page in the panel, under *Your app*, one set per application.

• Block an address or a range: one IP, or a block like 203.0.113.0/24 (IPv6 too).
• Block a machine: a PC that must not sign in again, whatever key it tries. Easiest from Sessions: press *Block this machine* (or *Block this IP*) on its row and the form is filled in.
• Block a country: by its two-letter code, when you do not sell there or most abuse comes from there.
• Block a network: a provider or data centre by its AS number, every address it owns.
• Block VPNs and proxies, and hosting addresses (servers and bot farms, not homes): two switches.
• Allowed addresses only: for a program used from known places, an office or your own servers. With one address in the list, every other address is refused.

What the customer's program gets is BLOCKED with your own words, set in Applications → Messages → Blocked. The key is not touched: not used up, not bound, not counted. Each rule shows how often it fired, and every refusal is in your Dashboard's activity as *Sign-in refused · Blocked by rule*. Add a rule with *Sign out the running copies* ticked and every copy it refuses is signed out within 30 seconds.

A rule is a blunt tool: it refuses everyone it matches, paying customers too. Prefer banning the one key when the problem is one customer; use a rule when the problem is a place or a machine. Docs: Rules.

Customer portal: your customers manage their own licence

Your customers can now open their licence on the web at pwfauth.com/customer, with just their licence key (no account).

• See the key: status and time left, or Lifetime.
• Move to a new PC: they free the key by themselves, following your rules in HWID resets → Self-service (on/off and the wait between two moves).
• See where it runs: the copies running now with their country, and sign any of them out.
• Activity: sign-ins and changes to the key, 10 per page.
• Several keys in one browser, even from different apps.

The key never stays in the browser, your notes and your staff are never shown, and guessing keys is blocked. Share the link with your customers, or point them to My licence in the site menu.

HWID resets

Keys that last hours

Keys can now be made by the hour, for trials, rentals or a quick test.

• Pick Hours as the length in Licences → Generate (2 = a 2-hour key). The clock starts on the customer's first sign-in, like every key.
• Add time now takes hours or days, on one key or many at once, and on user accounts too.
• Works in Import, Users, Store products and both APIs: "type": "hours" makes hour keys, {"hours": 2} adds time. The Developer API also returns hours_left.

Licences

Developer API

Manage your keys from your own Discord bot, store or server, without giving anyone your panel password.

• Make API keys on the new Developer API page, one app each, and tick only what each may do: see keys, make keys, add time, reset PCs, ban, edit or delete.
• GET /api/v1/keys/{key} returns the status, time left and the PCs (HWIDs) a key is bound to; POST /api/v1/keys makes keys.
• Optional allowed IP addresses, 120 calls a minute per key, and every change shows in the key's Logs and your webhooks.

Developer API

Webhooks

Your server, or a Discord channel, hears the moment something happens in your app: keys made, used for the first time, banned or deleted, new accounts, store orders, updates.

• Every delivery is signed (X-Webhook-Signature-V2), so your server can check it came from PWF Auth.
• A failed delivery is tried again after 1 minute, 5 minutes, 30 minutes and 2 hours.
• Pick the events, press Test, and see the last deliveries with what your server answered.

Webhooks

Store connections: keys delivered after payment

Connect the shop you sell from on the new Stores page, and every paid order gets its keys at once.

• SellAuth and Shoppex show the keys to the buyer right after paying.
• Stripe (Payment Links or Checkout) emails them; a full refund or a chargeback bans them.
• Your own server: one signed call per order, for any other shop or script.

Map each product to the keys it makes (length, PCs, keys per item). An order of a product you have not added waits for you to deliver it. How to connect

Status page and changelog

pwfauth.com/status shows whether the website, the licence API, the database and the bots are working, checked every 5 minutes, with 90 days of history and any incident. This changelog lists what changes on the platform.

Kotlin in the SDK generator

The SDK generator now writes a ready client for Kotlin (JVM, Java 11+), next to C#, VB.NET, Python, JavaScript, Java, PHP, Dart and C++. SDK generator

Discord bot

Add PWF Auth's bot to your Discord server and link it to one of your apps on the new Discord bot page.

• Customers claim their key with /redeem, see it with /mykeys and move to a new PC with /resethwid.
• Your staff make and manage keys with /key create, /key info, /key ban and more.
• A buyer role marks everyone with a valid key, and is taken back when the key ends.

Every answer is private. How it works