Skip to main content
This walkthrough is for machines that never reach AuthForge. It is unrelated to the grace period. If the machine can connect even occasionally, use online login() instead. There is one offline licensing product: a cloud-minted .authforge file. An activation request (.authforge-request) is only how the customer gets their HWID to you without email destroying it. The request is not signed, is not a license, and does not mint anything.

​
1. Customer: write a request file

At first run (or from About / Settings / Support), the app writes a .authforge-request next to itself, or to a path you choose. No network, no app secret, no login().
The customer emails you the file (or pastes the whole armored text, BEGIN/END lines included). Tell them not to type the HWID by hand. See Finding a machine’s HWID.

​
2. Operator: drop it in the mint dialog

  1. Open the license (Applications -> app -> Licenses -> license page) and click Mint .authforge file.
  2. Paste the request or click Upload .authforge-request. The dashboard parses it in the browser — there is no extra API call and no extra credit.
  3. Confirm the decoded fields (HWID, OS, created-at, app id). A damaged file shows this request file was damaged in transit, ask the customer to resend. A request for a different app is rejected before you mint.
  4. A customer with several machines can send several files. Add each one; they accumulate up to 16 HWIDs on one mint.
  5. Pick an expiry, click Mint & download. 1 credit is charged. Send them the .authforge file.

​
3. Customer: drop the .authforge next to the app

They put the file where your app looks for it and call loginFromFile. The SDK verifies it locally with your app public key, app id, and the same HWID the request contained. It never contacts AuthForge. If this returns hwid_mismatch, the file was bound to a different SDK’s fingerprint or the HWID was transcribed by hand. Ask for a new request from the same SDK; do not re-mint to the old string. See the offline license files page for the rest of the verify order.

​
What this is not

  • Not the grace period. Grace is signed session continuation after one online /auth/validate. It is held in memory only. Raising the grace cap does not help a machine that never connects.
  • Not a public minting endpoint. The client never receives a .authforge file from AuthForge. You mint; you send the file.
  • Not a second offline licensing product. The request has no authority. Anyone who can type a HWID into the dialog can equally forge a request.