App settings
Open an app and choose App settings.
Who sees what
Section titled “Who sees what”App settings have three levels instead of Own:
| Level | What the page offers |
|---|---|
| None | Nothing; the page isn’t in the sidebar |
| Some | The free mode switch and the client rules |
| All | Everything below, plus Seller API & stores |
General
Section titled “General”- Name of the app.
- Require Turnstile on register / login. Off by default. Native apps need an embedded browser (such as WebView2) to get a Turnstile token, so leave this off unless your app has one.
- Single session per user. A new sign-in signs out the user’s older sessions.
- HWID lock default for the app. Users and keys can override it.
Session timing
Section titled “Session timing”| Setting | Range | Meaning |
|---|---|---|
| Heartbeat (s) | 15 to 3600 | How often a running app checks in |
| Idle timeout (s) | 120 to 86400 | A session with no heartbeat for this long expires |
| Max session (s) | 300 to 2592000 | A session expires this long after sign-in, whatever happens |
The idle timeout must be at least twice the heartbeat. The presets:
| Preset | Heartbeat | Idle timeout | Trade-off |
|---|---|---|---|
| Real-time | 90 s | 15 min | Bans reach running apps within about 1.5 minutes |
| Balanced | 5 min | 30 min | About 3× fewer requests; bans within about 5 minutes |
| Free plan at scale | 10 min | 1 h | About 7× fewer requests; bans within about 10 minutes |
| Very long | 30 min | 2 h | About 20× fewer requests; bans within about 30 minutes |
A longer heartbeat only delays how fast a running app notices a ban or revoked key. New sign-ins are always refused at once.
Free mode
Section titled “Free mode”Lets people use the app without a key or account. See Free users.
Client rules
Section titled “Client rules”| Rule | Effect |
|---|---|
| Minimum version | Older clients get UPDATE_REQUIRED with the latest version and download link |
| Latest version | Shown to clients as an optional update |
| Download URL | Where to get the update (HTTPS). A fallback when no update build is set |
| Update build | Upload an installer (up to 95 MB). See Update builds |
| Minimum username length | 3 to 32 |
| HWID reset cooldown (hours) | Time between HWID resets, except an owner’s forced reset |
| Block leaked passwords | Refuse passwords found in public breaches at Create account (Have I Been Pwned; only 5 characters of a hash leave the server, and the check lets sign-ups through if it is unavailable) |
| Client messages | Your own wording for the errors your app shows |
Versions look like 1.4.2 (up to four numbers).
Client messages
Section titled “Client messages”You can reword what users see for these codes: INVALID_CREDENTIALS, USERNAME_TAKEN,
USERNAME_REQUIRED, USERNAME_TOO_SHORT, PASSWORD_LEAKED, USER_BANNED, USER_PAUSED,
BLACKLISTED, FREE_MODE_DISABLED, ACCOUNT_REQUIRED, LICENSE_INVALID, LICENSE_IN_USE,
LICENSE_BANNED, LICENSE_EXPIRED, HWID_MISMATCH, SESSION_INVALID, SESSION_EXPIRED,
UPDATE_REQUIRED, APP_DISABLED, VARIABLE_NOT_FOUND, FILE_NOT_FOUND, RATE_LIMITED. Up to 300
characters each. The SDK’s UserMessage() shows your text.
Prices
Section titled “Prices”The app’s currency, a price per tier and duration, and the limits on trial keys and free keys across the whole app (empty means no limit). See Sales and prices.
Key sets
Section titled “Key sets”A key set is what your app is built with: the HMAC secret, the encryption key and the response signing key, under a version number.
- Rotate keys creates a new key set and shows it once (with Generate config.h). The old set keeps working as previous, so clients you already shipped don’t break.
- Ship a build with the new
config.h, then Retire previous. Clients still on the retired set getPROTOCOL_ERROR. - Changes reach every Cloudflare location within about two minutes.
- Key sets made before response signing existed show Set up response signing. Do it, then copy
the
#define EONAUTH_RESPONSE_SIGNING_KEYline into yourconfig.h.
Delete this app
Section titled “Delete this app”Owners only. Type the app’s name to confirm. Clients are refused at once, then the app’s keys, users, sessions, variables, files, blacklist, webhooks, store products, API tokens and resellers are removed in batches. The audit log keeps its entries.