Core concepts
Account
Section titled “Account”Your EonAuth account holds everything you create: apps, keys, users, and the people you let into the panel. It is created the first time you sign in to the panel with Google, on the free plan. See Billing and plans.
An app is one program you protect. Each app has its own:
- app ID (
app_…) and a key set: an HMAC secret, an encryption key and a public response signing key that the SDK is built with. The panel generatesconfig.hfrom them. - tiers, license keys, users, variables, files, blacklist, webhooks and settings.
Nothing crosses between apps. A token, a reseller or a key from one app never works in another.
A tier (also called a subscription tier) is a level of access, such as Default and Pro. Each tier has a name and a level number; higher usually means more features. Every app starts with a Default tier.
A user can hold several tiers at once, each with its own expiry. Your app checks them with
HasTier("Pro"), and variables and files can be limited to tiers.
License keys
Section titled “License keys”A license key grants one tier for a length of time:
| Duration | Meaning |
|---|---|
| Day, Week, Month, 2 Months, Year | Presets |
| Lifetime | Never expires |
| Custom | Any number of days (staff only) |
| One-time | A single session, up to the app’s max session length (staff only) |
The clock starts when the key is first used, not when it’s generated. Keys are stored only as SHA-256 hashes, so a key is shown exactly once: in the response that created it. Each key also has a kind: paid, trial or free, which decides whether it books a sale. See License keys.
Every client that signs in is a user (an account in that app). There are two kinds:
- Password accounts are created with Create account: username, password and a license key.
- Key-login accounts are created the first time someone signs in with a key. The server asks for a username once, then links the key to a new account that has no password and signs in with its keys.
Redeeming another key for a tier the user already has extends it. A key for a different tier is added alongside. Revoking a key removes exactly the time it granted.
HWID lock
Section titled “HWID lock”By default an account is locked to one PC, identified by a hardware ID (HWID) the SDK computes. The lock is checked at every sign-in and heartbeat. You can turn it off for the whole app, for one user, or for one key. A HWID reset frees the lock so the user can move to a new PC; how many resets a user gets comes from their keys.
Sessions and heartbeats
Section titled “Sessions and heartbeats”Signing in creates a session. While the app runs, the SDK sends a heartbeat at the interval you choose per app. Each heartbeat re-checks the user against the database, so a ban, a revoked key or an expired subscription ends a running app at its next heartbeat. New sign-ins are refused at once.
Sessions also expire after an idle timeout (no heartbeat) and a max session length.
Variables
Section titled “Variables”Variables are values the server keeps (encrypted) and hands to signed-in clients one at a
time, by ID (var_…). There is no way for a client to list them. Each variable is open to every
active subscription or limited to specific tiers; a locked variable and an unknown ID give the same
VARIABLE_NOT_FOUND. Use them for the things a crack shouldn’t get: download links, config,
feature data. Up to 128 KB each.
Users also have per-user variables: up to 50 small values (4 KB each) your app stores on their own account.
Files are downloads (up to 25 MB) your app fetches by ID after sign-in, optionally limited to tiers. The SDK checks size and SHA-256 before handing you the bytes. An app can also host an update build (up to 95 MB) that old clients are sent to.
Free mode
Section titled “Free mode”With free mode on, your app can call LoginFree() and be used without a key or account. Each PC
becomes a free device. Free sessions have no tiers and can only read variables and files marked
Free users. When a free PC later signs in with a key, the panel counts it as a conversion.
People in the panel
Section titled “People in the panel”| Role | What they can do |
|---|---|
| Owner | Everything in the account |
| Manager | Per feature: None / Own / Team / All, on all apps or selected ones |
| Reseller | Generates keys in one app, within per-duration allowances; sees only their own keys |