Seats and devices
Limit each key to a set number of machines. A machine binds by HWID the first time it signs in, and you can revoke any one of them.
Each app gets its own Ed25519 key pair. The private key signs every successful sign-in and stays encrypted on our side. Your client checks the signature with the public key it ships with, so a proxy or a copied server can’t say yes on our behalf.
The SDKs do the checking, keep the session alive and handle revoke, kill and update signals.
// POST /api/v1/auth answered, signed with your app key { "ok": true, "sd": "v=1|ts=1760412600|nonce=a1b2|hwid=9f3c…|ok=1| username=|name=Pro|expires=1790000000|latest_version=2.4.1", "sig": "MEUCIQD9nQx2r8…Jb7bQ==" } sentry_verify(pubkey, sd, sig) // → true
using Sentry; var client = new SentryClient( baseUrl, appKey, publicKeyHex, useProtocolV2: true); var r = await client.AuthAsync("KEY-XXXX-YYYY"); if (r.Ok) { // verified fields, safe to read Console.WriteLine(r.Name); // license label Console.WriteLine(r.Expires); // or null = lifetime }
#include "sentry_auth.h" sentry_config cfg = {0}; cfg.base_url = base_url; cfg.app_key = app_key; cfg.pubkey_hex = pub_hex; cfg.use_proto3 = 1; sentry_client *c = sentry_client_new(&cfg, NULL); sentry_auth_result r; if (sentry_auth(c, "KEY-XXXX-YYYY", &r) == SENTRY_OK) { /* r.name, r.discord_username, r.text_hash: verified, safe to trust */ }
The shared Sentry bot, with a nickname of your choice in your server.
Your staff run a slash command in your server. Sentry mints a key tied to that member, gives them the customer role, sends the key by DM and tells you who sold it.
Role gates decide who can mint. One bot can serve several of your products; its commands ask which one.
Licenses, customers, devices, builds, webhooks, analytics and your team, managed from one place.
Limit each key to a set number of machines. A machine binds by HWID the first time it signs in, and you can revoke any one of them.
Push revoke, kill and update signals to running clients over a long-poll channel.
Sign-in volume, version adoption, operating systems and where your users are.
Upload a build in the dashboard. The SDK checks its hash and signature when it downloads it.
Invite teammates as admin, support or read-only. Every change lands in the audit log.
Get an HMAC-signed POST when a key is minted or redeemed, an unknown key is tried, a ban blocks a key sign-in or a build is downloaded. Scoped tokens let your own backend issue keys or ban a user.
Create an app in the dashboard. It gets a signing key pair; copy the public key into your client.
Issue keys with seats, an expiry and tags, one at a time or from a template, in the dashboard or from Discord.
Call auth from the SDK. It verifies the response before your app reads any field.
Successful sign-ins come back signed with your app’s key, and values reflected into the signed string are allowlisted. The protections below are on without any setup.
Every plan includes the dashboard, the APIs, the SDKs and signed authentication. Upgrade when you need higher limits or your own deployment.
For evaluating the API.
For products in production.
For scale or running it on your own servers.
Create an app, issue a license and sign in your first client in a few minutes.