Developers

SDKs and REST API

Official libraries that do the licence work inside your program: the encryption, the machine id, the sign-in and the heartbeat that closes your app when you ban a key. Pick yours, install it, and add a few lines

No library for your language? The same API is plain HTTPS and JSON. Call the REST API from anything that can send a request

Language	Package	Version	Checks the server's signature
C# and VB.NET	NuGet	1.5.2	Yes
Python	PyPI	1.3.1	Yes
JavaScript and TypeScript	npm	1.1.0	Not yet
C++	Release	1.3.1	Yes
Any language	REST API	HTTPS + JSON	Yes, your code checks it

.NET v1.5.2

C# and VB.NET

.NET Framework 4.6.2+ or .NET 6+ (netstandard2.0 and net8.0). WinForms, WPF, console and services

dotnet add package PWFAuth

NuGet Source on GitHub Full guide

Program.cs

using PWFAuth;

var client = new PwfClient(AppSecret);
client.SessionEnded += (s, e) => Application.Exit();   // banned, paused, expired: close the app

PwfResponse login = await client.LoginAsync(licenseKey);
if (!login.Success) { ShowError(login.Message); return; }

client.StartHeartbeat();                                // checks in every 30 seconds

Python v1.3.1

Python

Python 3.9+. One dependency, cryptography; HTTP comes from the standard library

pip install pwfauth

PyPI Source on GitHub

main.py

import os, sys
from pwfauth import PwfClient

client = PwfClient(os.environ["PWFAUTH_SECRET"])
client.on_session_ended = lambda code, message: os._exit(1)   # banned, paused, expired

login = client.login("XXXXX-XXXXX-XXXXX-XXXXX")
if not login.success:
    sys.exit(login.message)

client.start_heartbeat()

Node.js v1.1.0

JavaScript and TypeScript

Node 18+, no dependencies, TypeScript definitions included. Server side only: never bundle it into a web page

npm install pwfauth

npm Source on GitHub

Replies are encrypted and checked with your app secret; the check of PWF Auth's own signature is not in this version yet

index.js

import { PwfClient } from 'pwfauth';

const client = new PwfClient(process.env.PWFAUTH_SECRET);
client.on('sessionEnded', ({ errorCode, message }) => process.exit(1));

const login = await client.login('XXXXX-XXXXX-XXXXX-XXXXX');
if (!login.success) { console.error(login.message); process.exit(1); }

client.startHeartbeat();

C++ v1.3.1

C++

Windows, C++17 (Visual Studio). Uses WinHTTP and BCrypt from Windows, and nlohmann-json from vcpkg

PwfClient.h + PwfClient.cpp

Release Source on GitHub

main.cpp

#include "PwfClient.h"

PwfClient client(appSecret);
client.SetSessionEndedCallback([](auto& code, auto& msg) { PostQuitMessage(0); });

PwfResponse login = client.Login(licenseKey);
if (!login.Success()) { ShowError(login.Message()); return; }

client.StartHeartbeat();

REST API HTTPS

Any language: Go, Rust, Delphi, Swift, AutoIt, Lua, Ruby…

No package to install. Your program sends JSON over HTTPS to pwfauth.com/api/, the same endpoints every SDK uses. It needs AES-256-CBC, HMAC-SHA256 and RSA with SHA-256, which almost every language has in its standard library or a common package

https://pwfauth.com/api/

Sign inPOST /api/auth/login.php with the key and the machine id
Check inPOST /api/auth/heartbeat.php every 30 seconds; close the app when it is refused
Trust only signed repliesSend X-PWF-Nonce and verify X-PWF-Signature with the public key of PWF Auth

API reference The envelope Signed replies Error codes

POST https://pwfauth.com/api/auth/login.php
X-App-Secret: 3f9a6c0e…b71d2c21e
X-PWF-Nonce: 7c41d0a9…5e3f09be
{"p": "q9Xc0vU1mJ8yR2…kZ7T==", "t": 1760112000, "s": "9f2c41e7…a6e1"}

HTTP/1.1 200 OK
X-PWF-Signature: kD3mVx0q…Q9wE8A==

Android, step by step

The SDK generator's Android tab writes one Kotlin file for your app: licence keys or customer accounts, a device id for each phone, and the heartbeat that closes the app when you ban a key. The video goes from a new app in the panel to a ban on a real phone

The demo app on GitHub SDK generator

Another language?

SDK generatorIn your panel, the SDK generator writes a ready client file for your app in Java, Kotlin, Android, PHP, Dart or Delphi (and C#, VB.NET, Python, JavaScript and C++ too), with your server address and secret already in it
Your own clientAnything else talks to the REST API. The API reference has every endpoint, the encryption, the signed replies and a complete Python example to port

Whatever you use

Start the heartbeat. It is what closes your app when you ban, pause or end a key. Without it a key is only checked when the program starts
Close the app when the session ends Every SDK tells you why (banned, expired, a new PC, no connection) with a message written for your customer
Keep the app secret inside your program. Never in a public repository or a web page; if it leaks, make a new one in Applications
Keep the SDK up to date Fixes and security updates reach you as new versions
On the REST API, check every reply. Send a fresh X-PWF-Nonce and refuse a reply whose X-PWF-Signature is missing or does not verify; the SDKs do this for you

Every SDK, ready to use. Start free

Make an account, add your app, and sign in with your first key in a few minutes

Create a free account