Integrate EliteAuth with confidence.

Four steps to your first verified session.

Know what belongs in the client.

Choose the identity fields required by each application.

Application owners can require a license key only, a key plus username, a key plus email, or all three. On first activation EliteAuth links the license to the supplied user. Later activations must match the existing assignment.

Control systems and new-device redemptions separately.

Each license has a maximum number of simultaneously bound systems and an optional cumulative new-device redemption limit. Reopening or reactivating on an already-bound system does not consume another redemption.

Activate a license.

Validates the application, version, license state, expiry, and device binding. A successful request returns a short-lived session token.

{
  "app_id": "YOUR_APP_ID",
  "license_key": "ELITE-7F2K-9XQM-4LPA",
  "device_fingerprint": "ea-hw-v1:LOCAL_SHA256_FINGERPRINT",
  "fingerprint_version": "ea-hw-v1",
  "device_label": "DESKTOP-PC",
  "version": "1.0.0",
  "username": "customer_name",
  "email": "customer@example.com"
}

{
  "success": true,
  "message": "License activated successfully",
  "session": {
    "token": "SHORT_LIVED_TOKEN",
    "expires_at": "2026-07-21T12:30:00Z"
  }
}

Revalidate a session.

Call this during runtime for sensitive operations and on a reasonable interval. The API rechecks application status, license status, expiry, the active device fingerprint binding, and session expiry.

{
  "app_id": "YOUR_APP_ID",
  "session_token": "TOKEN_FROM_ACTIVATION",
  "device_fingerprint": "ea-hw-v1:LOCAL_SHA256_FINGERPRINT",
  "fingerprint_version": "ea-hw-v1"
}

Create licenses from the authenticated dashboard.

Choose a positive duration and unit, or explicitly select Lifetime. Timed licenses store their duration immediately and receive a real UTC expiration timestamp on first successful activation. Minutes, hours, days, and weeks use exact elapsed time; months and years use UTC calendar arithmetic with safe month-end clamping. Missing or invalid duration data is rejected and never falls back to Lifetime.

Use the client that fits your stack.

The package includes C#, C++, Python, JavaScript, TypeScript, Java, Go, and Rust clients. Desktop/server SDKs include hardware fingerprint helpers. Browser JavaScript cannot read CPU or motherboard identifiers, so browser integrations must use a trusted desktop bridge or a persistent installation identifier instead.

import { EliteAuthClient } from "./eliteauth.js";
import { generateHardwareFingerprint } from "./hardware-fingerprint.node.js";

const hardware = generateHardwareFingerprint();
const auth = new EliteAuthClient(
  "https://api.eliteauth.lol",
  "YOUR_APP_ID",
  "1.0.0"
);

const result = await auth.activate(
  licenseKey,
  hardware.fingerprint,
  { username, email },
  hardware.deviceLabel
);
if (!result.success) throw new Error(result.error);

const session = await auth.checkSession(hardware.fingerprint);

Integrate defensively.

• Never ship the application server secret or Supabase service-role key in client software.
• Use HTTPS only. If you later add browser-only API routes, restrict their allowed origins rather than relying on CORS as authentication.
• Use the bundled hardware fingerprint helper for desktop software. Do not use the system username as an HWID, and do not transmit raw ProcessorId, motherboard, UUID, or disk values.
• Treat client-side checks as bypassable. Keep high-value authorization decisions on infrastructure you control.
• Rotate any secret immediately after suspected exposure and disable affected licenses or applications while investigating.

For vulnerability reports, follow the Responsible Disclosure Policy or email security@eliteauth.lol.

Production checklist.