Reseller portal

For resellers: make keys, add time, credits and your account.

This page is for resellers: people who sell keys of a developer's app. The developer gives you a username, a password and credits; you make keys in the reseller portal at /reseller/ and send them to your customers. Developers: send this page to your resellers.

Use the username and password the app owner gave you. Forgot the password? Only the app owner can set a new one. Five wrong passwords lock the account for a few minutes.

With two-step sign-in on, a second step follows the password:

Telegram: @pwfauthbot sends a sign-in request with Approve / Deny buttons and a 6-digit code. Tap Approve and the page goes on by itself, or type the code. Deny stops the sign-in. A request lasts 5 minutes; Send again makes a new one.
Authenticator app: the 6-digit code from the app. When both are on, the page starts with Telegram and has a link to use the app instead.

Overview

Your credits, keys sold (with the last 14 days), keys sold today, active keys and credits spent. Under them, the prices of the app: what each kind of key costs. Make on a price starts a sale with it. When your credits run low, a line asks you to get a top-up from the app owner.

Make keys

Make keys asks for the price, how many keys (up to 100), the PCs per key (when the owner allows more than one), and optionally the customer's name and contact and a note. The window shows the total and what you have left before you confirm. The new keys open in a window: Copy all or Save as .txt. The time of a key starts when your customer first signs in.

My keys

Every key you sold, with its customer, status, end date and PCs. Search by key, customer, note or price, or click a card to filter. CSV downloads the list. On a key:

Add time: pick the days; the window shows the price before you confirm. It costs the same per day as the key was sold at, rounded up.
Customer & note: change them any time.
Reset PC: your customer moved to a new PC. The old one is signed out; the next sign-in binds the new one.
Ban: the customer's program closes on its next check-in. You can lift your own ban; a ban by the app owner only they can lift. Banning does not give credits back.

A means the key is out of your hands: the app owner deleted it, refunded it to you (its credits came back), or the customer added it to an account.

Credits

Your balance and every move of it: top-ups and take-backs by the app owner (with their note), each sale, time you added, and refunds. You pay the app owner the way you agreed with them, and they add the credits. If the owner deletes a key you sold, its credits come back to you here.

Account

At the top: your photo, name, credits, keys sold, last sign-in and whether two-step sign-in is on. Under it, three tabs.

Account
- Profile photo: click your picture, or drop one on the box. JPG, PNG, GIF or WebP up to 2 MB; it is cut to a square and made smaller, and animated ones keep moving. It shows in the portal and to the app owner in their list of resellers. Remove goes back to your initials.
- Public profile: your public name and contact (the app may show them to the customers who bought from you) and your email, which only the app owner sees.
- Time zone: Use this browser's zone picks it for you.
- Sign-in activity: when and from which address you last signed in.
Security
- Password: changing it signs out every other browser and ends your API tokens.
- Authenticator app: scan the QR code with an authenticator app (Google Authenticator, Authy…) and type its code. Each sign-in then asks for a code. Turning it off asks for a code and your password.
- Telegram: Connect Telegram shows a link and a QR code that open @pwfauthbot; press Start there and the page shows the chat as connected. Then Approve sign-ins in Telegram → Turn on (asks your password; other browsers and API tokens are signed out). Once connected, the bot also tells you about every new sign-in, a password change and two-step changes, and about your credits: credits added or taken back by the app owner (with their note), each sale (cost and balance), credits refunded, and when your balance drops under your warning line. Send test checks it works; Disconnect Telegram stops it all. One Telegram can hold several reseller accounts.
- Lost your phone? Ask the app owner to turn two-step sign-in off: it turns off both.
- Sign out everywhere else: every other browser and every API token.
Key format: how your keys look. When the app owner lets you choose, type your own, for example SHOP-########.

Automate it: the reseller API

Selling from your own shop or Telegram bot? The same things work over a small JSON API. Sign in once, then send the token as Authorization: Bearer <token>. A token lasts 24 hours; a new password, Sign out everywhere else or a suspension ends every token.

Call	Does
POST /api/reseller/login.php	{"username", "password"} → token. With two-step sign-in on: requires_2fa, a step1_token and method (totp or telegram; methods lists both when both are on) for POST totp.php?action=verify {"step1_token", "code"}. With Telegram approval on, the bot sends the code; send it as code (it works once, for 5 minutes).
GET me.php	Your balance, app, key format and sales of the last 14 days.
GET pricing.php	The prices on sale: id, label, duration_value, duration_unit, credits_cost.
POST generate-key.php	{"pricing_id", "count", "max_devices", "note", "customer_name", "customer_contact"} → keys, credits_spent, balance. 402 when credits are short, 429 over the per-minute or per-day limit.
GET keys.php	Your keys: ?status=unused\|active\|expired\|banned\|paused\|redeemed\|deleted&q=&limit=&offset=.
POST key-action.php?action=…	reset-hwid, ban, unban, extend with {"key_id", "extra_days"}.
GET topups.php	Your credit history.
POST key-format.php	{"key_format"}, when the app owner lets you choose.
POST logout.php · sign-out-all.php	End this token, or every token and portal session.

Answers are JSON with "success": true|false and a message. Keep the token secret: it can spend your credits.

Something missing or unclear? Tell us on Telegram.