Developer API Overview

The AuthForge Developer API lets you manage licenses programmatically from your own backend. Use it to create licenses after Stripe payments, revoke access, manage variables, configure webhooks, and more.

Base URL

https://api.authforge.cc/v1/

All endpoints are prefixed with /v1/.

Authentication

Every request must include your API key in the Authorization header as a Bearer token:

Authorization: Bearer af_live_your_key_here

API keys are created in the Dashboard under Settings → API Keys. Keys are prefixed with af_live_ for identification. Each key is scoped to your account and can manage licenses across all of your applications; the target app is specified per-request via the appId field or URL parameter.

API keys are shown only once when created. Store them securely. If compromised, delete the key in the dashboard and create a new one.

Rate limits

Limit	Value
Burst	100 requests/second
Sustained	50 requests/second

If you exceed the rate limit, you’ll receive HTTP 429 with the Developer API error shape (error + message). Back off and retry with exponential backoff. Public SDK endpoints on auth.authforge.cc (/auth/validate, /auth/heartbeat, /auth/selfban) use different limits and a different JSON body on failure: { "status": "failed", "error": "rate_limited" }. /auth/validate has extra per-IP and per-license application limits; /auth/heartbeat has a per-license limit (6/min) but no per-IP limit. See Error Codes Reference.

Credits

License management calls (create, list, update, delete, variables, webhooks, security) do not consume credits. Two things do: SDK authentication (1 credit per successful validate, 1 per 10 heartbeats) and minting an offline license file via POST /v1/licenses/{licenseKey}/offline-files (1 credit per successful mint, debited from the app owner’s balance; rejected mints are free). See Managing Credits for details.

Response format

All responses return JSON. Successful responses include the requested data directly:

{
  "licenses": [...],
  "cursor": null
}

Error responses include an error code and a human-readable message:

{
  "error": "not_found",
  "message": "Resource not found"
}

Pagination

List endpoints use cursor-based pagination. If more results are available, the response includes a cursor value. Pass it as a query parameter in the next request:

# First page
curl "https://api.authforge.cc/v1/licenses?appId=YOUR_APP_ID&limit=100" \
  -H "Authorization: Bearer af_live_your_key"

# Next page
curl "https://api.authforge.cc/v1/licenses?appId=YOUR_APP_ID&limit=100&cursor=eyJsaW..." \
  -H "Authorization: Bearer af_live_your_key"

When cursor is null, you’ve reached the last page.

Endpoints

Licenses

Method	Path	Description
POST	`/v1/licenses`	Create one or more licenses
GET	`/v1/licenses`	List licenses for an app
GET	`/v1/licenses/:licenseKey`	Get a single license
PUT	`/v1/licenses/:licenseKey`	Revoke, activate, extend, or reset HWID
DELETE	`/v1/licenses/:licenseKey`	Permanently delete a license

Variables

Method	Path	Description
GET	`/v1/apps/:appId/variables`	Get app variables
PUT	`/v1/apps/:appId/variables`	Set app variables
GET	`/v1/licenses/:licenseKey/variables`	Get license variables
PUT	`/v1/licenses/:licenseKey/variables`	Set license variables

Webhooks

Method	Path	Description
POST	`/v1/apps/:appId/webhooks`	Create a webhook
GET	`/v1/apps/:appId/webhooks`	List webhooks
PUT	`/v1/apps/:appId/webhooks/:webhookId`	Update a webhook
DELETE	`/v1/apps/:appId/webhooks/:webhookId`	Delete a webhook
POST	`/v1/apps/:appId/webhooks/:webhookId/test`	Send a test event

Security

Method	Path	Description
GET	`/v1/apps/:appId/security`	Get security config
PUT	`/v1/apps/:appId/security`	Update security config
POST	`/v1/apps/:appId/security/blacklist`	Add to blacklist
DELETE	`/v1/apps/:appId/security/blacklist`	Remove from blacklist
POST	`/v1/apps/:appId/security/whitelist`	Add to whitelist
DELETE	`/v1/apps/:appId/security/whitelist`	Remove from whitelist

Error codes

See the Error Codes Reference for a complete list of error codes across all endpoints.

​Base URL

​Authentication

​Rate limits

​Credits

​Response format

​Pagination

​Endpoints

​Licenses

​Variables

​Webhooks

​Security

​Error codes

Base URL

Authentication

Rate limits

Credits

Response format

Pagination

Endpoints

Licenses

Variables

Webhooks

Security

Error codes