How protection works

Sessions, the heartbeat, machine binding and how fast a ban reaches the app.

Knowing what happens between your program and PWF Auth helps you answer customers and set the right expectations. Everything below is what the server does today.

Signing in starts a session

When a customer enters their key, your program sends it to PWF Auth together with the PC's hardware ID (HWID). If the key is valid, the server answers with the licence details and a session: one running copy of your program on one PC. You see every session live in Sessions.

The heartbeat

While the program runs, the SDK asks the server every 30 seconds: "is my session still good?". That question is the heartbeat. Each answer re-checks everything: is the key banned, paused, expired or deleted, was its machine reset, is the app in maintenance?

The server cannot reach your program on its own (customers sit behind home routers), so it waits for the next heartbeat to deliver bad news. That is why a ban is not instant:

You do this in the panel	The program learns it	What the customer sees
Ban, pause or delete a key	within 30 s	BANNED / PAUSED / the licence no longer exists
End session in Sessions	within 30 s	"This session was ended by the developer. You can sign in again."
Reset machines / approve an HWID reset	within 30 s	"The hardware ID of this license was reset…"
Key reaches its expiry date	within 30 s	EXPIRED

In our own tests the program closed 26–27 seconds after the click. The interval is a server setting (HEARTBEAT_INTERVAL); installed programs pick a new value up the next time they sign in.

When the internet drops

If three heartbeats in a row get no answer (about 90 seconds), the SDK ends the session itself with NETWORK_LOST. Without this rule, blocking PWF Auth in a firewall would keep the program running forever. In Sessions such a session shows as Timed out once it has been silent for five minutes.

Machine binding (HWID)

The first sign-in binds the key to that PC. A key made for one machine refuses any other PC with HWID_MISMATCH; a key allowed several machines refuses the next one with DEVICE_LIMIT. A customer who changed PC can move the licence: by themselves if you allow it, or by asking you. See HWID resets.

Encryption and replay protection

Every sign-in, heartbeat and content request is encrypted with AES-256 and signed with HMAC-SHA256, using two keys made from your app secret. Each message carries a timestamp, and the server refuses one that is more than five minutes off, so a recorded request cannot be played back later. An answer that is not encrypted and signed is never trusted as a success: the SDK treats it like no answer at all.

A PC whose clock is wrong still works: since SDK 1.2 the server sends its own time with the refusal and the SDK corrects itself.

Free trials

If you switch trials on for an application, a new PC can get a trial key with one call (CreateTrialAsync), without buying. Each PC gets one trial; the length is set on the application.

Something missing or unclear? Tell us on Telegram.