KeyAux Docs

KeyAux API Reference

Welcome to the KeyAux API documentation. KeyAux provides a powerful authentication and licensing platform with three API layers:

Dashboard API

Manage applications, licenses, users, and settings from the web dashboard. Authenticated via JWT.

Client API

KeyAuth-compatible API for your desktop/mobile apps. Session-based authentication with HWID locking.

Seller API

Programmatic license and user management via API keys. Perfect for integrating with your store or bot.

Authentication

KeyAux uses three authentication methods depending on the API:

APIMethodHeader
DashboardJWT Bearer TokenAuthorization: Bearer <token>
ClientSession IDPassed in request body as sessionid
SellerAPI KeyX-API-Key: <key> or ?sellerkey=<key>
Getting a JWT: Call POST /api/auth/login or POST /api/auth/register to receive a JWT token. Include it in the Authorization header for all Dashboard API requests.
Getting a Seller Key: Create seller keys from the Dashboard under Seller Keys. Keys start with ka_.

Base URL

All API requests should be made to:

Base URL
https://keyaux.caelen.workers.dev

All responses are JSON with the following structure:

JSON Response
{
  "success": true,
  "message": "Operation result",
  // ... additional data
}

Error Handling

KeyAux uses standard HTTP status codes alongside a success boolean in every response.

CodeMeaning
200Success
201Created successfully
400Bad request — missing or invalid parameters
401Unauthorized — invalid or expired token/key
404Not found — resource doesn't exist or you don't own it
409Conflict — resource already exists
500Internal server error
Error Response Example
{
  "success": false,
  "message": "Username or email already exists"
}
POST /api/auth/register

Create a new KeyAux account. Returns a JWT token and user info. A default seller API key is automatically created.

Request Body

FieldTypeRequiredDescription
usernamestringYesUnique username
emailstringYesUnique email address
passwordstringYesMin 6 characters
Request
curl -X POST https://keyaux.caelen.workers.dev/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myuser",
    "email": "me@example.com",
    "password": "securepass123"
  }'
Response 201
{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "user": {
    "id": "abc123...",
    "username": "myuser",
    "email": "me@example.com",
    "plan": "free"
  }
}
POST /api/auth/login

Log in with username (or email) and password. Returns a JWT token valid for 7 days.

Request Body

FieldTypeRequiredDescription
usernamestringYesUsername or email
passwordstringYesAccount password
Request
curl -X POST https://keyaux.caelen.workers.dev/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myuser",
    "password": "securepass123"
  }'
Response 200
{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "user": {
    "id": "abc123...",
    "username": "myuser",
    "email": "me@example.com",
    "plan": "free",
    "role": "user"
  }
}
GET /api/dashboard/auth/me JWT Required

Get the currently authenticated user's profile.

Request
curl https://keyaux.caelen.workers.dev/api/dashboard/auth/me \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"
Response 200
{
  "success": true,
  "user": {
    "id": "abc123...",
    "username": "myuser",
    "email": "me@example.com",
    "plan": "free",
    "role": "user",
    "created_at": "2026-02-09T12:00:00.000Z"
  }
}
PUT /api/dashboard/auth/password JWT Required

Change the authenticated user's password.

Request Body

FieldTypeRequiredDescription
current_passwordstringYesCurrent password
new_passwordstringYesNew password
Request
curl -X PUT https://keyaux.caelen.workers.dev/api/dashboard/auth/password \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "current_password": "oldpass",
    "new_password": "newpass123"
  }'
GET /api/dashboard/stats JWT Required

Get aggregate stats across all your applications.

Response 200
{
  "success": true,
  "stats": {
    "applications": 3,
    "users": 142,
    "licenses": 500,
    "logs": 1280
  }
}

Applications

Manage your applications. Each application has its own set of users, licenses, variables, and settings.

GET /api/dashboard/apps JWT Required

List all your applications.

Response 200
{
  "success": true,
  "applications": [
    {
      "id": "abc123",
      "name": "My App",
      "secret": "as_xxxx...",
      "version": "1.0",
      "hwid_lock": 1,
      "anti_vpn": 0,
      "paused": 0,
      "created_at": "2026-02-09T12:00:00.000Z"
    }
  ]
}
POST /api/dashboard/apps JWT Required

Create a new application. A default subscription is automatically created.

Request Body

FieldTypeRequiredDescription
namestringYesApplication name
versionstringNoVersion string (default: "1.0")
GET /api/dashboard/apps/:appId JWT Required

Get a single application with stats (users, licenses, active sessions, logs).

PUT /api/dashboard/apps/:appId JWT Required

Update application settings.

Request Body

FieldTypeRequiredDescription
namestringNoApp name
versionstringNoApp version
hwid_lockbooleanNoEnable HWID locking
anti_vpnbooleanNoEnable VPN detection
hash_checkbooleanNoEnable hash checking
pausedbooleanNoPause application
POST /api/dashboard/apps/:appId/reset-secret JWT Required

Regenerate the application secret key.

DELETE /api/dashboard/apps/:appId JWT Required

Delete an application and all associated data.

Licenses

Generate and manage license keys for your applications.

GET /api/dashboard/licenses/:appId JWT Required

List licenses with pagination, search, and status filtering.

Query Parameters

ParamTypeDefaultDescription
pageint1Page number
limitint50Items per page
searchstringSearch key, note, or used_by
statusstringFilter: active, used, banned
POST /api/dashboard/licenses/:appId JWT Required

Generate license key(s).

Request Body

FieldTypeDefaultDescription
countint1Number of keys (max 500)
maskstringXXXXX-XXXXX-XXXXX-XXXXX-XXXXXKey format (X = random char)
duration_daysint30License validity in days
levelint1Subscription level
max_usesint1Max activations
notestringInternal note
Request
curl -X POST https://keyaux.caelen.workers.dev/api/dashboard/licenses/APP_ID \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "count": 5,
    "duration_days": 30,
    "mask": "XXXX-XXXX-XXXX-XXXX",
    "note": "Batch #1"
  }'
Response 201
{
  "success": true,
  "licenses": [
    { "id": "abc...", "license_key": "A1B2-C3D4-E5F6-G7H8" },
    { "id": "def...", "license_key": "I9J0-K1L2-M3N4-O5P6" }
  ],
  "count": 5
}
POST /api/dashboard/licenses/:appId/:licenseId/ban JWT Required

Ban a license key.

DELETE /api/dashboard/licenses/:appId/:licenseId JWT Required

Delete a single license.

DELETE /api/dashboard/licenses/:appId/unused/all JWT Required

Delete all unused licenses for an application.

DELETE /api/dashboard/licenses/:appId/used/all JWT Required

Delete all used licenses for an application.

Users

Manage end users (app users) who authenticate via the Client API.

GET /api/dashboard/users/:appId JWT Required

List users with pagination and search.

Query Parameters

ParamTypeDefaultDescription
pageint1Page number
limitint50Items per page
searchstringSearch username, email, HWID, or IP
GET /api/dashboard/users/:appId/:userId JWT Required

Get a single user with their variables.

POST /api/dashboard/users/:appId JWT Required

Manually create an app user.

Request Body

FieldTypeRequiredDescription
usernamestringYesUsername
passwordstringYesPassword
emailstringNoEmail address
levelintNoSubscription level (default: 1)
subscription_namestringNoSubscription tier name
subscription_daysintNoDays until expiry
POST /api/dashboard/users/:appId/:userId/ban JWT Required

Ban a user. Optionally include { "reason": "..." } in the body.

POST /api/dashboard/users/:appId/:userId/unban JWT Required

Unban a user.

POST /api/dashboard/users/:appId/:userId/reset-hwid JWT Required

Reset a user's hardware ID lock.

POST /api/dashboard/users/:appId/:userId/extend JWT Required

Extend a user's subscription.

Request Body

FieldTypeDefaultDescription
daysint30Days to add
subscription_namestringOptionally change sub name
DELETE /api/dashboard/users/:appId/:userId JWT Required

Delete a user.

DELETE /api/dashboard/users/:appId/all/users JWT Required

Delete all users for an application.

Subscriptions

Manage subscription tiers for your applications.

GET /api/dashboard/subscriptions/:appId JWT Required

List subscription tiers.

POST /api/dashboard/subscriptions/:appId JWT Required

Create a subscription tier.

Request Body

FieldTypeDefaultDescription
namestringTier name (e.g., "Premium")
levelint1Access level
duration_daysint30Default duration in days
DELETE /api/dashboard/subscriptions/:appId/:subId JWT Required

Delete a subscription tier.

Variables

Key-value store for your application. Supports global (app-wide) and per-user variables.

Global Variables

GET /api/dashboard/variables/:appId/global JWT Required

List all global variables for an app.

POST /api/dashboard/variables/:appId/global JWT Required

Create or update a global variable.

Request Body

FieldTypeRequiredDescription
keystringYesVariable key
valuestringNoVariable value
DELETE /api/dashboard/variables/:appId/global/:varId JWT Required

Delete a global variable.

User Variables

GET /api/dashboard/variables/:appId/user JWT Required

List user variables. Optionally filter by ?user_id=....

POST /api/dashboard/variables/:appId/user JWT Required

Set a user variable.

Request Body

FieldTypeRequiredDescription
user_idstringYesTarget user ID
keystringYesVariable key
valuestringNoVariable value
DELETE /api/dashboard/variables/:appId/user/:varId JWT Required

Delete a user variable.

Webhooks

Create webhooks that can be triggered from client applications.

GET /api/dashboard/webhooks/:appId JWT Required

List all webhooks for an app.

POST /api/dashboard/webhooks/:appId JWT Required

Create a webhook.

Request Body

FieldTypeRequiredDescription
namestringYesWebhook name
urlstringYesTarget URL
user_agentstringNoCustom User-Agent
bodystringNoDefault request body
auth_headerstringNoAuthorization header value
DELETE /api/dashboard/webhooks/:appId/:webhookId JWT Required

Delete a webhook.

Blacklist

Block IPs or hardware IDs from accessing your application.

GET /api/dashboard/blacklist/:appId JWT Required

List all blacklist entries.

POST /api/dashboard/blacklist/:appId JWT Required

Add an entry to the blacklist.

Request Body

FieldTypeRequiredDescription
typestringYesip or hwid
valuestringYesThe IP or HWID to block
notestringNoReason/note
DELETE /api/dashboard/blacklist/:appId/:entryId JWT Required

Remove an entry from the blacklist.

Logs

View and manage activity logs for your applications.

GET /api/dashboard/logs/:appId JWT Required

List logs with pagination and filtering.

Query Parameters

ParamTypeDefaultDescription
pageint1Page number
limitint100Items per page
actionstringFilter by action type
searchstringSearch username, IP, or data
DELETE /api/dashboard/logs/:appId JWT Required

Clear all logs for an application.

Seller Keys

Manage API keys for the Seller API. Keys start with ka_.

GET /api/dashboard/seller-keys JWT Required

List all your seller API keys.

POST /api/dashboard/seller-keys JWT Required

Create a new seller API key.

Request Body

FieldTypeRequiredDescription
namestringNoKey label (default: "New Key")
DELETE /api/dashboard/seller-keys/:keyId JWT Required

Delete a seller API key.

Client API Overview

The Client API is designed for use in your desktop, mobile, or game applications. It is KeyAuth-compatible — existing KeyAuth SDKs and libraries will work with KeyAux.

Single Endpoint: All client API requests go to POST /api/1.2/ with a type parameter that determines the operation. Supports both JSON and form-encoded bodies.
Session Flow: Always call init first to get a sessionid, then use that session ID for all subsequent requests.

Supported Request Types

TypeDescription
initInitialize session
loginUser login
registerUser registration
licenseLicense-only authentication
upgradeUpgrade subscription with key
checkValidate session
varGet user variable
setvarSet user variable
getvarGet global variable
logAdd log entry
webhookExecute webhook
fetchOnlineGet online users
checkblackCheck blacklist
banSelf-ban
POST /api/1.2/ type: init

Initialize a session. Must be called before any other client API request.

Parameters

FieldTypeRequiredDescription
typestringYes"init"
namestringYesApplication name
owneridstringYesOwner account ID
verstringNoExpected app version
Request
curl -X POST https://keyaux.caelen.workers.dev/api/1.2/ \
  -H "Content-Type: application/json" \
  -d '{
    "type": "init",
    "name": "My App",
    "ownerid": "YOUR_ACCOUNT_ID",
    "ver": "1.0"
  }'
Response 200
{
  "success": true,
  "message": "Initialized",
  "sessionid": "session_abc123...",
  "appinfo": {
    "numUsers": "142",
    "numOnlineUsers": "23",
    "numKeys": "500",
    "version": "1.0",
    "customerPanelLink": ""
  }
}
POST /api/1.2/ type: login

Login an end user. Validates credentials, HWID, subscription, and blacklist status.

Parameters

FieldTypeRequiredDescription
typestringYes"login"
sessionidstringYesSession from init
usernamestringYesUsername
passstringYesPassword
hwidstringNoHardware ID
Response 200
{
  "success": true,
  "message": "Logged in",
  "info": {
    "username": "player1",
    "subscriptions": [{
      "subscription": "default",
      "key": "",
      "expiry": "2026-03-09T12:00:00.000Z",
      "timeleft": 28,
      "level": "1"
    }],
    "ip": "1.2.3.4",
    "hwid": "ABC123DEF456",
    "createdate": "2026-01-09T12:00:00.000Z",
    "lastlogin": "2026-02-09T12:00:00.000Z"
  }
}
POST /api/1.2/ type: register

Register a new end user. Optionally requires a license key.

Parameters

FieldTypeRequiredDescription
typestringYes"register"
sessionidstringYesSession from init
usernamestringYesUsername
passstringYesPassword
keystringNoLicense key
emailstringNoEmail
hwidstringNoHardware ID
POST /api/1.2/ type: license

Authenticate using only a license key (no user account required).

Parameters

FieldTypeRequiredDescription
typestringYes"license"
sessionidstringYesSession from init
keystringYesLicense key
hwidstringNoHardware ID
POST /api/1.2/ type: upgrade

Upgrade/extend a user's subscription using a license key.

Parameters

FieldTypeRequiredDescription
typestringYes"upgrade"
sessionidstringYesSession from init
usernamestringYesUsername
keystringYesLicense key
POST /api/1.2/ type: check

Check if a session is still valid.

Parameters

FieldTypeRequiredDescription
typestringYes"check"
sessionidstringYesSession from init
POST /api/1.2/ type: var

Get a user-specific variable. Requires an active logged-in session.

Parameters

FieldTypeRequiredDescription
typestringYes"var"
sessionidstringYesSession (must be logged in)
varstringYesVariable key
POST /api/1.2/ type: setvar

Set a user-specific variable. Creates or updates.

Parameters

FieldTypeRequiredDescription
typestringYes"setvar"
sessionidstringYesSession (must be logged in)
varstringYesVariable key
datastringNoVariable value
POST /api/1.2/ type: getvar

Get a global (app-wide) variable.

Parameters

FieldTypeRequiredDescription
typestringYes"getvar"
sessionidstringYesSession from init
varstringYesVariable key (or use varid)
POST /api/1.2/ type: log

Add a log entry from the client application.

Parameters

FieldTypeRequiredDescription
typestringYes"log"
sessionidstringYesSession from init
pcuserstringNoPC username / identifier
messagestringNoLog message
POST /api/1.2/ type: webhook

Execute a pre-configured webhook from the client.

Parameters

FieldTypeRequiredDescription
typestringYes"webhook"
sessionidstringYesSession from init
webidstringYesWebhook ID
paramsstringNoURL query params to append
bodystringNoCustom request body
conttypestringNoContent-Type (default: application/json)
POST /api/1.2/ type: fetchOnline

Fetch a list of currently online users.

Parameters

FieldTypeRequiredDescription
typestringYes"fetchOnline"
sessionidstringYesSession from init
Response 200
{
  "success": true,
  "users": [
    { "credential": "player1" },
    { "credential": "player2" }
  ]
}
POST /api/1.2/ type: checkblack

Check if the current user's IP or HWID is blacklisted.

Parameters

FieldTypeRequiredDescription
typestringYes"checkblack"
sessionidstringYesSession from init
hwidstringNoHardware ID to check
POST /api/1.2/ type: ban

Self-ban the currently logged-in user. Used as an anti-tamper mechanism.

Parameters

FieldTypeRequiredDescription
typestringYes"ban"
sessionidstringYesSession (must be logged in)

Seller API Overview

The Seller API allows programmatic management of licenses and users via API keys. Perfect for integrating with payment processors, Discord bots, or custom store fronts.

Authentication: Include your seller key as an X-API-Key header or as a sellerkey query parameter.
Endpoint: All requests use GET /api/seller/ with the type query parameter.
Example Request
curl "https://keyaux.caelen.workers.dev/api/seller/?sellerkey=ka_xxx&type=add&appname=MyApp&expiry=30&amount=5"

Seller License Operations

GET /api/seller/?type=add Seller Key

Generate license key(s).

Query Parameters

ParamTypeRequiredDescription
sellerkeystringYesSeller API key
typestringYesadd
appnamestringYesApplication name
expiryintNoDuration in days (default: 30)
maskstringNoKey format mask
levelintNoSubscription level
amountintNoNumber of keys (max 500)
notestringNoInternal note
Response 200
{
  "success": true,
  "message": "License(s) created",
  "key": "A1B2C-D3E4F-G5H6I-J7K8L-M9N0P",
  "keys": ["A1B2C-...", "Q1R2S-..."]
}
GET /api/seller/?type=verify Seller Key

Verify a license key exists and get its details.

Query Parameters

ParamRequiredDescription
appnameYesApplication name
keyYesLicense key to verify
GET /api/seller/?type=del Seller Key

Delete a license key. Params: appname, key.

GET /api/seller/?type=ban Seller Key

Ban a license key. Params: appname, key.

GET /api/seller/?type=unban Seller Key

Unban a license key. Params: appname, key.

GET /api/seller/?type=fetchallkeys Seller Key

Fetch all license keys for an app. Params: appname.

GET /api/seller/?type=delalllicenses Seller Key

Delete all licenses. Params: appname.

GET /api/seller/?type=delunused Seller Key

Delete all unused licenses. Params: appname.

GET /api/seller/?type=delused Seller Key

Delete all used licenses. Params: appname.

Seller User Operations

GET /api/seller/?type=adduser Seller Key

Create a user.

Query Parameters

ParamRequiredDescription
appnameYesApplication name
userYesUsername
passNoPassword (default: "default")
subNoSubscription name
expiryNoExpiry in days
GET /api/seller/?type=deleteuser Seller Key

Delete a user. Params: appname, user.

GET /api/seller/?type=userdata Seller Key

Get user details. Params: appname, user.

GET /api/seller/?type=banuser Seller Key

Ban a user. Params: appname, user, reason (optional).

GET /api/seller/?type=unbanuser Seller Key

Unban a user. Params: appname, user.

GET /api/seller/?type=resetuser Seller Key

Reset a user's HWID. Params: appname, user.

GET /api/seller/?type=extend Seller Key

Extend a user's subscription.

Query Parameters

ParamRequiredDescription
appnameYesApplication name
userYesUsername
subNoSubscription name
expiryNoDays to add (default: 30)
GET /api/seller/?type=subtract Seller Key

Subtract time from a user's subscription. Params: appname, user, seconds.

GET /api/seller/?type=setvar Seller Key

Set a user variable. Params: appname, user, var, data.

GET /api/seller/?type=getvar Seller Key

Get a user variable. Params: appname, user, var.

GET /api/seller/?type=fetchallusers Seller Key

Fetch all users for an app. Params: appname.

GET /api/seller/?type=delexpusers Seller Key

Delete all expired users. Params: appname.

Seller App Operations

GET /api/seller/?type=resetapp Seller Key

Reset all application data (users, licenses, sessions, logs, variables, blacklist). The application itself is preserved.

Query Parameters

ParamRequiredDescription
appnameYesApplication name
Warning: This action is irreversible. All users, licenses, sessions, logs, variables, and blacklist entries will be permanently deleted.