Skip to main content

Building with AI?

Copy this into your agent chat so it loads AuthForge docs and follows the default licensing model:
Full walkthrough and tips: Developing with AI.

1. Create an account

Sign up at authforge.cc. You’ll receive free credits to get started.

2. Create an app

Go to the Dashboard and click Create App. Give it a name; this represents the software you’re protecting.

3. Copy your credentials

After creating the app, copy your App ID, App Secret, and Public Key. The secret is shown once; store it securely.
Your App Secret authenticates validate requests. Your Public Key verifies signed server responses. Keep the secret private; the public key is safe to embed in shipped SDK code.

4. Install the SDK

Add the official package for your stack (import the authforge module after pip install authforge-sdk). C++ ships as a CMake library from GitHub; see the C++ SDK page for FetchContent or find_package. Full options and versions are on each language page.

Python

PyPI authforge-sdk: Python 3.9+

C#

NuGet AuthForge: .NET 6+

C++

CMake + GitHub; C++17

Node.js

npm @authforgecc/sdk: Node.js 18+
TypeScript: the npm package ships authforge.d.ts; import from @authforgecc/sdk like JavaScript.

5. Add the SDK to your project

6. Create a license key

In the dashboard, open your app and click Generate Licenses. Set the quantity, expiration (or lifetime), and HWID slots (how many devices can use the same key). Click Generate. Copy one of the generated keys; the format is XXXX-XXXX-XXXX-XXXX.

7. Run your app

Launch your application and enter the license key when prompted. You should see “Authenticated!”; the license is now active and bound to your machine.

8. What just happened?

Here’s what the SDK did behind the scenes:
  1. Collected HWID: The SDK fingerprinted your machine by collecting stable hardware identifiers and hashing them into a SHA-256 string. The exact identifiers vary by SDK language (e.g., MAC address, CPU, disk serial, hostname).
  2. Generated a nonce: A random string to prevent replay attacks. Every request uses a fresh nonce.
  3. Sent a validate request: POST /auth/validate with your App ID, App Secret, license key, HWID, and nonce.
  4. Server validated: The server checked the license exists, is active, hasn’t expired, and the HWID is allowed (or bound it to a new slot). One credit was deducted from your account.
  5. Signed the response: The server built a JSON payload (session token, app/license variables, etc.) and signed the base64 payload with the app’s Ed25519 private key.
  6. SDK verified: The SDK verified the signature with your app’s public key (public_key). This proves the response came from AuthForge and wasn’t tampered with in transit.
  7. Grace period started: Your app now runs on the signed session with no further network calls. The SDK re-verifies the session signature locally in the background and stops when the session expires (24 hours by default, configurable via the SDK’s ttl option, clamped to 1 hour minimum and 7 days maximum). If you need faster revocation, enable online check-ins: periodic signed POST /auth/heartbeat calls, every 15 minutes by default.
This online activate + grace period flow is the default and the right choice for almost every app. If a customer’s machine can never reach the internet, that is a different product mode: offline license files (.authforge), which you mint in the dashboard and the SDK verifies with loginFromFile. Do not reach for it unless you need it.

Next steps

  • SDK Best Practices; How to handle errors, the grace period, and graceful shutdown
  • Core Concepts; Understand HWIDs, the grace period, online check-ins, credits, and more
  • Commerce; Connect Stripe and automate license delivery