Strict game isolation
Every key belongs to one game. A Call of Duty key can never open Free Fire — the prefix is cosmetic, the database decides.
invite-only · ed25519 signed
License authority
for multi-game software
Issue keys per game, bind them to devices, and answer every client with a signed verdict your app can actually trust.
- signatures
- Ed25519
- requests
- HMAC-SHA256
- tokens
- JWT · 15 min
$ loader --key COD-A8K2-M9PX-7QWL-3ABC → POST /api/v1/license/auth x-ka-signature hmac-sha256 ✓ x-ka-nonce 3f1c0e9a… (single use) ← 200 signed by rsk_2026_6f40 ✓ signature verified ✓ request id matches ✓ license active expires in 29d 23h ✓ device bound 1 / 1 → access granted
// running on this signet
Free Fire FF
// features
Everything a key needs. Nothing it doesn't.
Signed verdicts
Requests are HMAC-signed and single-use. Responses are signed with Ed25519 and bound to your request id.
Device binding
Per-license device limits, blocking, HWID resets and client reset requests with cooldowns.
Invite-only
Closed by design. Admins join with codes the owner issues; clients join with an invite or the key they bought.
Every event, logged
Authentication, activity and security logs with approximate location and automatic retention.
Runs anywhere PHP runs
Plain PHP and MySQL. No Node, Redis or cron — built for free shared hosting.
// how it works
Three commands to ship.
- 01
Register a game
Pick a prefix, upload the logo, choose plans. Create an application to get API credentials.
games create --prefix COD - 02
Generate keys
One or five hundred at a time. Keys are shown once and stored only as hashes.
licenses generate --plan 30d --count 100 - 03
Verify in your client
Pin the public key, call
license/auth, trust only signed answers.sdk.authenticate(key, hwid)
// security
Fail closed. Always.
An unsigned answer is a rejected answer. Tampered bodies, replayed nonces, foreign games and stale timestamps are refused — and logged.
- ✓ Argon2id passwords, CSRF tokens, strict CSP
- ✓ License keys and HWIDs stored as keyed hashes
- ✓ Short-lived JWTs re-checked against live state
- ✓ Key rotation without downtime
- ✓ Rate limits against key enumeration
Got an invite or a key?
Create your account in seconds — your license is linked automatically.