KeyAux API

A modern, developer-friendly authentication and software licensing platform. Clean RESTful endpoints, consistent JSON responses, and no legacy cruft.

Client API

Integrate license validation, user auth, and more with clean RESTful endpoints.

Seller API

Manage licenses, users, and app data programmatically for reseller integrations.

Dashboard API

Full CRUD for apps, licenses, users, variables, webhooks, blacklists, and more.

Authentication

KeyAux uses three authentication methods depending on the API:

API	Auth Method	Header
Client API	App Secret + Session Token	`X-App-Secret` + `X-Session-Token`
Seller API	Seller API Key	`X-Seller-Key`
Dashboard API	JWT Bearer Token	`Authorization: Bearer <token>`

Client API Auth Flow

Every Client API request requires the X-App-Secret header. For user-level operations, you also need a session token:

Send X-App-Secret with every request to identify your app
Call /users/login, /users/register, or /licenses/activate to get a session_token
Send X-Session-Token on subsequent requests requiring an authenticated user

Tip: Simple operations like POST /licenses/validate or GET /blacklist/check only need the app secret — no session required.

Base URL

https://api.keyaux.com

Client API: /api/v1/ • Seller API: /api/v1/seller/ • Dashboard API: /api/dashboard/

Error Handling

All responses follow a consistent JSON structure:

Success

{ "success": true, "message": "...", "data": { ... } }

Error

{ "success": false, "error": "error_code", "message": "Human-readable description" }

Common Error Codes

Code	HTTP	Description
`missing_app_secret`	401	X-App-Secret header not provided
`invalid_app_secret`	401	App secret is wrong
`app_paused`	403	Application is paused
`missing_session`	401	X-Session-Token required
`invalid_session`	401	Session expired or invalid
`not_authenticated`	401	Need logged-in user session
`blacklisted`	403	IP or HWID is blacklisted
`invalid_credentials`	401	Wrong username or password
`banned`	403	Account is banned
`hwid_mismatch`	403	Hardware ID mismatch
`version_mismatch`	400	App version outdated
`missing_signature`	401	HMAC enabled but signature headers missing
`signature_expired`	401	Signature timestamp outside 5-min window
`invalid_signature`	401	HMAC signature verification failed

HMAC Request Signing

For additional security, you can enable HMAC-SHA256 request signing on any application. When enabled, every Client API request must include a valid signature — preventing request tampering and replay attacks.

Optional: HMAC signing is disabled by default. Enable it per-app from the Dashboard API when you need stronger request integrity.

Setup

Generate an HMAC secret: POST /api/dashboard/apps/:appId/hmac-secret
Store the returned hmac_secret (prefixed hk_) in your client application
Sign every Client API request using the scheme below

Signing Scheme

Construct the signature message as:

Signature Message

{timestamp}.{METHOD}.{path}.{body}

Where:

Component	Description	Example
`timestamp`	Current Unix epoch in seconds	`1740700800`
`METHOD`	HTTP method, uppercased	`POST`
`path`	Request pathname (no query string)	`/api/v1/init`
`body`	Raw request body (empty string for GET)	`{"version":"1.0"}`

Compute HMAC-SHA256(hmac_secret, message) and send as a hex string.

Required Headers

Header	Description
`X-Signature`	Hex-encoded HMAC-SHA256 signature
`X-Signature-Timestamp`	Unix timestamp used in the signature (must be within 5 minutes of server time)

Python Example

import hmac, hashlib, time, json, requests

secret = "hk_your_hmac_secret"
timestamp = str(int(time.time()))
method = "POST"
path = "/api/v1/init"
body = json.dumps({"version": "1.0"})

message = f"{timestamp}.{method}.{path}.{body}"
signature = hmac.new(secret.encode(), message.encode(), hashlib.sha256).hexdigest()

resp = requests.post("https://api.keyaux.com" + path,
    headers={
        "X-App-Secret": "as_your_app_secret",
        "X-Signature": signature,
        "X-Signature-Timestamp": timestamp,
        "Content-Type": "application/json"
    },
    data=body
)

JavaScript / Node.js Example

const crypto = require('crypto');

const secret = 'hk_your_hmac_secret';
const timestamp = Math.floor(Date.now() / 1000).toString();
const method = 'POST';
const path = '/api/v1/init';
const body = JSON.stringify({ version: '1.0' });

const message = `${timestamp}.${method}.${path}.${body}`;
const signature = crypto.createHmac('sha256', secret).update(message).digest('hex');

fetch('https://api.keyaux.com' + path, {
  method,
  headers: {
    'X-App-Secret': 'as_your_app_secret',
    'X-Signature': signature,
    'X-Signature-Timestamp': timestamp,
    'Content-Type': 'application/json'
  },
  body
});

HMAC Error Codes

Code	HTTP	Description
`missing_signature`	401	HMAC is enabled but X-Signature or X-Signature-Timestamp header is missing
`signature_expired`	401	Timestamp is more than 5 minutes from server time
`invalid_signature`	401	Signature does not match the expected value

Dashboard Management

POST/api/dashboard/apps/:appId/hmac-secretJWT

Generate (or rotate) an HMAC secret and enable signing. Returns the new secret — store it securely, it cannot be retrieved again.

Response

{
  "success": true,
  "hmac_secret": "hk_a1b2c3d4e5f6...",
  "message": "HMAC secret generated and signing enabled"
}

DELETE/api/dashboard/apps/:appId/hmac-secretJWT

Disable HMAC signing and remove the secret. Client API requests will no longer require signatures.

Tip: You can also toggle hmac_enabled via PUT /api/dashboard/apps/:appId without rotating the secret.

Account Auth

Create and manage your KeyAux dashboard account. These are for app owners, not end users.

POST/api/auth/register

Register a new dashboard account.

Body

Field	Type	Required	Description
`username`	string	Yes	3-32 characters
`email`	string	Yes	Valid email
`password`	string	Yes	Min 6 characters

curl

curl -X POST https://api.keyaux.com/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username":"myaccount","email":"me@example.com","password":"secret123"}'

POST/api/auth/login

Login. Returns a JWT for Dashboard API access.

Body

Field	Type	Required	Description
`username`	string	Yes	Username
`password`	string	Yes	Password

Response

{ "success": true, "token": "eyJhbG...", "user": { "id": "abc", "username": "myaccount" } }

GET/api/dashboard/auth/meJWT

Get the current dashboard user's profile.

curl

curl https://api.keyaux.com/api/dashboard/auth/me \
  -H "Authorization: Bearer YOUR_JWT"

Client API

The Client API is what you integrate into your software. Clean, individual REST endpoints — no single-endpoint multiplexer.

All endpoints below are prefixed with /api/v1 and require X-App-Secret. Some additionally require X-Session-Token.

Method	Endpoint	Auth	Description
POST	`/init`	Secret	Init session, version check
GET	`/app/info`	Secret	Get app statistics
POST	`/users/login`	Secret	Login end user
POST	`/users/register`	Secret	Register end user
POST	`/licenses/activate`	Secret	Login with license key
POST	`/licenses/validate`	Secret	Check if key is valid
POST	`/licenses/upgrade`	Session+User	Upgrade subscription
GET	`/session`	Session	Check session
DELETE	`/session`	Session	Logout
GET	`/user`	Session+User	Get current user
GET	`/variables/:key`	Session	Get global variable
GET	`/user/variables`	Session+User	List user variables
GET	`/user/variables/:key`	Session+User	Get user variable
PUT	`/user/variables/:key`	Session+User	Set user variable
DELETE	`/user/variables/:key`	Session+User	Delete user variable
GET	`/online`	Session	Online users
POST	`/logs`	Session	Submit log
POST	`/webhooks/:id`	Session	Trigger webhook
GET	`/blacklist/check`	Secret	Check blacklist
POST	`/user/change-password`	Session+User	Change password
POST	`/user/ban`	Session+User	Self-ban

Initialize Session

POST/api/v1/initApp Secret

Initialize a session and get app info. Optionally check client version.

Body

Field	Type	Required	Description
`version`	string	No	Client version to verify

curl

curl -X POST https://api.keyaux.com/api/v1/init \
  -H "X-App-Secret: your_app_secret" \
  -H "Content-Type: application/json" \
  -d '{"version":"1.0"}'

Response

{
  "success": true,
  "message": "Session initialized",
  "data": {
    "session_token": "abc123def456...",
    "app": {
      "name": "My App",
      "version": "1.0",
      "total_users": 150,
      "online_users": 12,
      "total_keys": 500
    }
  }
}

User Login

POST/api/v1/users/loginApp Secret

Authenticate an end user. Validates credentials, HWID, subscription, and blacklist. Returns session token + user info.

Body

Field	Type	Required	Description
`username`	string	Yes	Username
`password`	string	Yes	Password
`hwid`	string	No	Hardware ID for device locking

curl

curl -X POST https://api.keyaux.com/api/v1/users/login \
  -H "X-App-Secret: your_app_secret" \
  -H "Content-Type: application/json" \
  -d '{"username":"player1","password":"pass123","hwid":"ABC-DEF-123"}'

Response

{
  "success": true,
  "message": "Login successful",
  "data": {
    "session_token": "xyz789...",
    "user": {
      "username": "player1",
      "level": 1,
      "hwid": "ABC-DEF-123",
      "subscription": {
        "name": "default",
        "expiry": "2026-03-09T00:00:00.000Z",
        "days_left": 28
      },
      "created_at": "2026-02-01T...",
      "last_login": "2026-02-09T..."
    }
  }
}

User Register

POST/api/v1/users/registerApp Secret

Register a new end user. Optionally provide a license key to activate a subscription.

Body

Field	Type	Required	Description
`username`	string	Yes	3-32 characters
`password`	string	Yes	Min 6 characters
`email`	string	No	Email address
`key`	string	No	License key to activate
`hwid`	string	No	Hardware ID

Activate License

POST/api/v1/licenses/activateApp Secret

Authenticate with just a license key — no username/password needed. Returns a session.

Body

Field	Type	Required	Description
`key`	string	Yes	License key
`hwid`	string	No	Hardware ID

Response

{
  "success": true,
  "message": "License activated",
  "data": {
    "session_token": "sess_abc123...",
    "license": {
      "key": "ABCDE-12345-FGHIJ-67890-KLMNO",
      "level": 1,
      "expiry": "2026-03-11T00:00:00.000Z",
      "days": 30,
      "uses_remaining": 0,
      "note": null
    }
  }
}

Validate License

POST/api/v1/licenses/validateApp Secret

Check if a license key is valid without consuming a use. Great for pre-flight checks.

Body

Field	Type	Required	Description
`key`	string	Yes	License key to validate

Response

{
  "success": true,
  "data": {
    "valid": true,
    "status": "active",
    "level": 1,
    "duration_days": 30,
    "uses": { "current": 0, "max": 1 },
    "expires_at": null,
    "created_at": "2026-02-09T..."
  }
}

Upgrade Subscription

POST/api/v1/licenses/upgradeSession + User

Extend a logged-in user's subscription using a license key.

Body

Field	Type	Required	Description
`key`	string	Yes	License key to consume

curl

curl -X POST https://api.keyaux.com/api/v1/licenses/upgrade \
  -H "X-App-Secret: your_app_secret" \
  -H "X-Session-Token: your_session_token" \
  -H "Content-Type: application/json" \
  -d '{"key":"XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"}'

Session & User

GET/api/v1/sessionSession

Check if the current session is valid. Returns user info if authenticated.

DELETE/api/v1/sessionSession

Destroy the current session (logout).

GET/api/v1/userSession + User

Get the authenticated user's full profile including subscription info.

curl

curl https://api.keyaux.com/api/v1/user \
  -H "X-App-Secret: your_app_secret" \
  -H "X-Session-Token: your_session_token"

Variables

Two types: global (app-level, read-only to clients) and user (per-user, read-write).

GET/api/v1/variables/:keySession

Get a global (app-level) variable.

GET/api/v1/user/variablesSession + User

List all user variables. Returns { "variables": { "key": "value", ... } }

GET/api/v1/user/variables/:keySession + User

Get a specific user variable.

PUT/api/v1/user/variables/:keySession + User

Create or update a user variable. Body: { "value": "..." }

curl

curl -X PUT https://api.keyaux.com/api/v1/user/variables/highscore \
  -H "X-App-Secret: your_app_secret" \
  -H "X-Session-Token: your_session_token" \
  -H "Content-Type: application/json" \
  -d '{"value":"9001"}'

DELETE/api/v1/user/variables/:keySession + User

Delete a user variable.

More Endpoints

GET/api/v1/app/infoApp Secret

Get app stats (users, online, keys) without creating a session.

GET/api/v1/onlineSession

Get online users. Returns { "count": 3, "users": ["p1","p2","p3"] }

POST/api/v1/logsSession

Submit a log entry. Body: { "message": "...", "pcuser": "..." }

POST/api/v1/webhooks/:idSession

Trigger a pre-configured webhook. Body: { "params": "...", "body": "...", "content_type": "..." }

GET/api/v1/blacklist/checkApp Secret

Check if IP/HWID is blacklisted. Query: ?hwid=xxx

POST/api/v1/user/change-passwordSession + User

Change password. Body: { "current_password": "...", "new_password": "..." }

POST/api/v1/user/banSession + User

Self-ban the authenticated user. Irreversible from client side.

Seller API

Manage licenses, users, and app data programmatically. All endpoints require X-Seller-Key header.

URL pattern: /api/v1/seller/{APP_NAME}/licenses, /api/v1/seller/{APP_NAME}/users, etc.

Example URLs

https://api.keyaux.com/api/v1/seller/MyApp/licenses
https://api.keyaux.com/api/v1/seller/MyApp/users/player1/ban
https://api.keyaux.com/api/v1/seller/MyApp/stats

Seller — Licenses

POST/api/v1/seller/:app/licenses

Create license keys.

Body

Field	Type	Default	Description
`count`	int	1	Number of keys (max 500)
`duration_days`	int	30	Days per key
`level`	int	1	Subscription level
`max_uses`	int	1	Max uses per key
`mask`	string	XXXXX-XXXXX-...	Key format (X=random)
`note`	string		Internal note

curl

curl -X POST https://api.keyaux.com/api/v1/seller/MyApp/licenses \
  -H "X-Seller-Key: ka_your_seller_key" \
  -H "Content-Type: application/json" \
  -d '{"count":5,"duration_days":30,"mask":"KA-XXXXX-XXXXX"}'

GET/api/v1/seller/:app/licenses

List all licenses. Query: ?page=1&limit=100&status=active

GET/api/v1/seller/:app/licenses/:key

Get license details.

DELETE/api/v1/seller/:app/licenses/:key

Delete a license key.

POST/api/v1/seller/:app/licenses/:key/ban

Ban a license key.

POST/api/v1/seller/:app/licenses/:key/unban

Unban a license key.

POST/api/v1/seller/:app/licenses/bulk-delete

Bulk delete licenses. Body: { "filter": "unused" | "used" | "expired" | "all" }

Seller — Users

POST/api/v1/seller/:app/users

Create a user. Body: { "username", "password", "email", "subscription", "duration_days", "level" }

GET/api/v1/seller/:app/users

List users. Query: ?page=1&limit=100&search=player

GET/api/v1/seller/:app/users/:username

Get user data including all variables.

DELETE/api/v1/seller/:app/users/:username

Delete user and all their data.

POST/api/v1/seller/:app/users/:username/ban

Ban a user. Body: { "reason": "..." }. Kills active sessions.

POST/api/v1/seller/:app/users/:username/unban

Unban a user.

POST/api/v1/seller/:app/users/:username/reset-hwid

Reset user's hardware ID lock.

POST/api/v1/seller/:app/users/:username/extend

Extend subscription. Body: { "days": 30, "subscription": "premium" }

curl

curl -X POST https://api.keyaux.com/api/v1/seller/MyApp/users/player1/extend \
  -H "X-Seller-Key: ka_your_seller_key" \
  -H "Content-Type: application/json" \
  -d '{"days":30}'

POST/api/v1/seller/:app/users/:username/subtract

Subtract time. Body: { "seconds": 0, "days": 0 }

POST/api/v1/seller/:app/users/:username/edit

Edit user. Body: { "email", "level", "subscription", "password", "hwid" } (all optional)

GET/api/v1/seller/:app/users/:username/variables/:key

Get user variable.

PUT/api/v1/seller/:app/users/:username/variables/:key

Set user variable. Body: { "value": "..." }

DELETE/api/v1/seller/:app/users/:username/variables/:key

Delete user variable.

POST/api/v1/seller/:app/users/bulk-delete

Bulk delete users. Body: { "filter": "expired" | "banned" | "all" }

Seller — App Management

GET/api/v1/seller/:app/stats

Get app statistics.

Response

{
  "success": true,
  "data": {
    "app": { "name": "MyApp", "version": "1.0", "paused": false },
    "users": { "total": 150, "online": 12 },
    "licenses": { "total": 500, "active": 300, "used": 180, "banned": 20 },
    "logs": 5420
  }
}

POST/api/v1/seller/:app/reset

⚠️ Reset all app data. Body: { "confirm": true }

Dashboard API

Full CRUD for managing apps from the web dashboard. Requires Authorization: Bearer <jwt>.

Base path: /api/dashboard/ — Used by dash.keyaux.com. For programmatic access, prefer the Seller API.

Resource	Path	Operations
Applications	`/api/dashboard/apps`	List, Create, Update, Delete
Licenses	`/api/dashboard/licenses/:appId`	List, Create, Delete, Ban
Users	`/api/dashboard/users/:appId`	List, Create, Update, Delete, Ban
Variables	`/api/dashboard/variables/:appId`	List, Create, Update, Delete
Logs	`/api/dashboard/logs/:appId`	List, Clear
Webhooks	`/api/dashboard/webhooks/:appId`	List, Create, Update, Delete
Blacklist	`/api/dashboard/blacklist/:appId`	List, Add, Remove
Subscriptions	`/api/dashboard/subscriptions/:appId`	List, Create, Delete
Seller Keys	`/api/dashboard/seller-keys`	List, Create, Delete
HMAC Signing	`/api/dashboard/apps/:appId/hmac-secret`	Generate, Disable
Stats	`/api/dashboard/stats`	Get overview

API Tester

Test endpoints directly from your browser. Credentials are saved locally.

App Secret

Session Token

Seller Key

JWT Token

Load Preset

Headers

Request Body

Response

Send a request to see the response here.