Authentication and licensing
The auth mode is set per application and enforced by the backend on every request, so the client can't be talked into a flow you didn't enable.
- License keys, username and password, or both — selected per application.
- Login, Register, and License entry points — on the C++ client, or over REST from any language.
- Restricted modes reject the wrong entry point with AUTH_MODE_RESTRICTED.
- HWID binding per application, with hardware ID resets from the dashboard.
Sessions and live control
Sessions are visible while they run, and the backend keeps a channel open to act on them.
- Init opens a session; Check and Heartbeat keep it verified.
- WebSocket transport delivers push events — kill and ban are the terminal ones.
- With auto_exit enabled, fatal detections and kill instructions terminate the process.
- Live session, user, and license state in the developer dashboard.
Runtime protection
Protection is server-driven rather than baked in at compile time: the flags ride init and every heartbeat, so a dashboard toggle applies without the client reconnecting.
- anti_debug, anti_vm, anti_hv, anti_http_debug, and anti_attach returned by the backend.
- Heartbeat carries live runtime flags, so enforcement can change mid-session.
- Shield entry points (ShieldInit, ShieldDecrypt, ShieldShutdown) for encrypted code sections.
- Owner id can be sealed with SecureCredential rather than shipped as a plain string.
Data and integrations
The pieces most apps end up needing, without standing up your own service for them.
- Global variables, per-user variables, and online counts.
- File delivery and webhooks.
- Blacklist and whitelist controls, plus abuse alerts.
- Subscriptions and reseller management.