Configuration (config.h)

Your app is built with its app ID and key set. The panel writes them into a config.h for you.

Generating it

In the panel, Generate config.h appears whenever a key set is shown:

• right after New app on the Dashboard, and
• after App settings → Key sets → Rotate keys.

The key set is shown once. Copy the file before closing the dialog.

What’s in it

// Generated by the admin panel for app_0123456789abcdef0123456789abcdef (key version 1).
#pragma once
#include <cstdint>

namespace demo_config {
    inline constexpr const wchar_t* kApiHost = L"api.eonauth.fyi";
    inline constexpr std::uint16_t kApiPort = 443;
    inline constexpr const char* kAppId = "app_0123456789abcdef0123456789abcdef";
    inline constexpr std::uint32_t kKeyVersion = 1;

    // HMAC signing secret, XOR-masked. Kept separate from the encryption key.
    inline constexpr std::uint8_t kHmacSecretMasked[32] = { /* … */ };
    inline constexpr std::uint8_t kHmacSecretPad[32] = { /* … */ };

    // AES-256-GCM payload key, XOR-masked with an independent pad.
    inline constexpr std::uint8_t kEncKeyMasked[32] = { /* … */ };
    inline constexpr std::uint8_t kEncKeyPad[32] = { /* … */ };
}

// Ed25519 public key for response signatures. Not secret: it can only verify.
#define EONAUTH_RESPONSE_SIGNING_KEY "…base64…"

namespace demo_pins {
    inline constexpr const char* kSpkiPins[] = { "USE_CLOUDFLARE_CA_PINS" };
}

Constant	Meaning
kApiHost, kApiPort	api.eonauth.fyi, 443
kAppId	Your app ID
kKeyVersion	The key set’s version; goes up with each rotation
kHmacSecretMasked / kHmacSecretPad	The HMAC secret, split into two XOR halves
kEncKeyMasked / kEncKeyPad	The encryption key, split with an independent pad
EONAUTH_RESPONSE_SIGNING_KEY	The public key every response is checked against
kSpkiPins	USE_CLOUDFLARE_CA_PINS uses the built-in pins. See TLS pinning

Never commit a real config.h

The masking keeps the secrets out of a plain strings dump. A reverse engineer with a debugger can still recover them, so treat them as extractable. That’s why the server rate-limits, locks accounts to PCs, and can revoke at once.

If you keep config.h in git, commit a placeholder and run git update-index --skip-worktree config.h locally.

Include config.h in one .cpp file only, so the masked secrets are compiled once.

Building the Config

#include "eonauth.h"
#include "config.h"

eonauth::Config MakeConfig() {
    eonauth::Config cfg;
    cfg.host       = demo_config::kApiHost;
    cfg.port       = demo_config::kApiPort;
    cfg.appId      = demo_config::kAppId;
    cfg.keyVersion = demo_config::kKeyVersion;
    cfg.hmacSecret = eonauth::UnmaskSecret(demo_config::kHmacSecretMasked, demo_config::kHmacSecretPad, 32);
    cfg.encKey     = eonauth::UnmaskSecret(demo_config::kEncKeyMasked, demo_config::kEncKeyPad, 32);
    cfg.responseSigningKey = EONAUTH_RESPONSE_SIGNING_KEY;
    cfg.appVersion = "1.4.2";   // compared with the minimum version in App settings
    return cfg;
}

Config fields

Field	Default	Notes
host		Hostname only: no scheme, path, port or credentials
port	443
appId		app_…
keyVersion	1	Must match the key set
hmacSecret		32 bytes
encKey		32 bytes, different from hmacSecret
responseSigningKey		Base64 Ed25519 public key. Required; Init fails without it
appVersion	empty	Your version, like 1.4.2. Empty skips the version check
spkiPins	empty	Empty = Cloudflare’s CA roots. Any pin here replaces that set
persistSession	true	Save the session (DPAPI-encrypted) so ResumeSession works after a restart
autoHeartbeat	true	Send heartbeats in the background while signed in
allowInsecureLocalhost	false	Plain HTTP, honoured only for localhost

Init checks the configuration before connecting and fails with a message naming the field: a missing or placeholder app ID, keys of the wrong length, no signing key, a host with a scheme or path, or plain HTTP for anything but localhost.

After Init succeeds, call eonauth::WipeSecrets(cfg) to clear your copy of the keys. The SDK keeps its own, encrypted in memory.

Rotating keys

Each key set has its own signing key, so a rotated config.h has a new EONAUTH_RESPONSE_SIGNING_KEY too.

1. App settings → Key sets → Rotate keys. Copy the new config.h. Clients you already shipped keep working on the previous set.
2. Ship a build with the new config.h and give users time to update.
3. Retire previous. Clients still on the old set now get PROTOCOL_ERROR.

Changes take about two minutes to reach every Cloudflare location.

Key sets from before response signing

If App settings shows Set up response signing for your key set, do it, then paste the #define EONAUTH_RESPONSE_SIGNING_KEY line the panel copies for you into your config.h.