Getting Started
Introduction
ZentryAuth provides high-performance authentication infrastructure built for developers, desktop software, and automated reseller networks. This guide walks you through authenticating client applications, distributing binaries securely, and integrating the Seller API.
💡
Base Endpoint: All API v1 requests should be sent over HTTPS to https://api.zentryauth.com/v1 using your application credentials.
Choose between three authentication architectures based on your product needs: License Key validation, User & Password logins, or Hybrid Key-Claiming.
Getting Started
Quick Start
Follow these core steps to initialize and validate software licenses in your client application.
1
Initialize Application
Fetch your APP_KEY from the ZentryAuth panel and configure your API base URL.
2
Activate & Bind HWID
Send the license key along with the client hardware ID (HWID) and version string.
3
Maintain Active Session
Store the returned session token and periodically validate it during execution.
bash
Copy
# Quickstart Activate Example
curl -X POST "https://api.zentryauth.com/v1/YOUR_APP_KEY/license/activate" \
-H "Content-Type: application/json" \
-d '{
"key": "XXXX-XXXX-XXXX-XXXX",
"hwid": "PC-HWID-9921",
"version": "1.0.0"
}'
⚠️
Security Warning: Always retrieve HWID directly from system APIs on the user machine. Never hardcode static HWIDs in production builds.
Getting Started
Authentication
Requests sent to ZentryAuth require standard HTTP headers and valid payload schemas.
Required Headers
http
Copy
Content-Type : application/json
Accept : application/json
Supported Authentication Modes
License Key
User / Password
Hybrid
Configure the mode of your application inside the panel settings. Endpoints enforce strict mode checks and return mode mismatch errors if called out of scope.
Core API
License Mode
Key-based authentication designed for instant software access, device locking, and automated expiration.
1. Init Check (Optional)
POST
/v1/{app_key}/init
Checks if the app is active, in maintenance mode, or requires a version update.
Request Copy
{
"version" : "1.0.0"
}
Response Copy
{
"success" : true ,
"code" : "OK" ,
"data" : {
"app_name" : "My Desktop App" ,
"version" : "1.0.0" ,
"maintenance" : false
}
}
2. Activate License
POST
/v1/{app_key}/license/activate
Validates key status, binds HWID on first use, and issues a session token.
Request Copy
{
"key" : "XXXX-XXXX-XXXX-XXXX" ,
"hwid" : "PC-HWID-9921" ,
"version" : "1.0.0"
}
Response Copy
{
"success" : true ,
"code" : "OK" ,
"data" : {
"token" : "sess_88192a910..." ,
"expires_at" : "2026-12-31 23:59:59"
}
}
Request Parameters
Parameter
Type
Required
Description
key
string
Yes
The license key issued by admin or reseller.
hwid
string
Yes
Unique hardware fingerprint of client machine.
version
string
Yes
Current version string of client executable.
3. Validate Session
POST
/v1/{app_key}/license/validate
Verifies an active session token and client HWID binding.
Request Copy
{
"token" : "sess_88192a910..." ,
"hwid" : "PC-HWID-9921" ,
"version" : "1.0.0"
}
Response Copy
{
"success" : true ,
"code" : "OK" ,
"message" : "Session valid"
}
Core API
User / Password Mode
Account-based authentication for applications requiring registered usernames, passwords, and custom user credentials.
POST
/v1/{app_key}/user/login
Authenticates user credentials and checks active hardware bindings.
Request Copy
{
"login" : "john_doe" ,
"password" : "secret123" ,
"hwid" : "PC-HWID-9921" ,
"version" : "1.0.0"
}
Response Copy
{
"success" : true ,
"data" : {
"token" : "sess_user_7712..." ,
"username" : "john_doe" ,
"email" : "john@example.com"
}
}
Core API
Hybrid Mode
Combines key distribution with user creation. Claiming a key generates a user account instantly in one request.
💡
Hybrid Architecture: After executing /claim, the client authenticates using standard User/Password endpoints.
POST
/v1/{app_key}/hybrid/claim
Claims an unassigned license key and registers a user account simultaneously.
Request Copy
{
"key" : "XXXX-XXXX-XXXX-XXXX" ,
"username" : "john_doe" ,
"password" : "secret123" ,
"email" : "john@example.com" ,
"hwid" : "PC-HWID-9921"
}
Response Copy
{
"success" : true ,
"code" : "CLAIMED" ,
"message" : "Account created successfully"
}
Seller API
Seller API Overview
Server-to-server endpoints allowing Discord bots, external webshops, and automated billing tools to generate and manage keys without panel logins.
🔒
Server-Side Credentials: Never expose your Seller Key or Secret inside client software. Use them strictly on your backend server or Discord bot host.
Required Headers
http
Copy
X-Seller-Key : your_seller_key
X-Seller-Secret : your_seller_secret
Content-Type : application/json
Seller API
License Operations
Automate key generation, HWID resets, bans, and info lookups through server requests.
Create License
POST
/seller/v1/licenses/create
Generates a new license key with custom duration, mask format, and prefix.
Request Copy
{
"duration_type" : "days" ,
"duration_value" : 30 ,
"key_prefix" : "VIP"
}
Response Copy
{
"success" : true ,
"data" : {
"license_key" : "VIP-9812-7712-0091" ,
"duration" : "30 days"
}
}
Request Parameters
Parameter
Type
Required
Description
duration_type
string
Yes
Duration unit: "days", "weeks", "months", or "lifetime".
duration_value
integer
Yes
Numeric duration value (e.g. 7, 30, 90).
key_prefix
string
No
Custom prefix string for generated key (e.g. "PRO").
Reset License HWID
POST
/seller/v1/licenses/reset
Clears the bound hardware ID from a license, allowing the user to reactivate on a new device.
Request Copy
{
"license_key" : "VIP-9812-7712-0091"
}
Response Copy
{
"success" : true ,
"message" : "HWID reset successfully"
}
Seller API
User Operations
Manage registered accounts, update passwords, and issue HWID resets remotely via API.
POST
/seller/v1/users/create
Creates a new user account with specified duration and password.
Request Copy
{
"username" : "jane_doe" ,
"password" : "secret123" ,
"duration_days" : 30
}
Response Copy
{
"success" : true ,
"data" : {
"username" : "jane_doe" ,
"expires_at" : "2026-08-20"
}
}
Webhooks
Discord Webhook Automation
Automate recurring Discord announcements, branding, and status updates directly bound to your applications.
📡
Branding & Variables: Custom logos, banners, and embed colors can be set per webhook. Use dynamic variables like {user}, {app}, and {license} in message bodies.
File Distribution
Software Releases & Distribution
Publish DLLs, EXEs, and software installers safely. Uploaded files undergo SHA256 integrity verification and automated antivirus scanning.
Public Manifest Endpoint
GET
/releases/{release_id}/manifest.json
Returns release metadata, version, file size, SHA256 checksum, and scan status.
Response Copy
{
"release_id" : 102 ,
"version" : "1.0.4" ,
"file_name" : "Launcher-v1.0.4.exe" ,
"size_bytes" : 14820104 ,
"sha256" : "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" ,
"scan_status" : "clean"
}
Reference
Error Codes
Standardized response codes returned by ZentryAuth endpoints.
Code
HTTP Status
Description
INVALID_LICENSE
400
The key provided is invalid, unassigned, or malformed.
HWID_MISMATCH
403
The client HWID does not match the bound hardware fingerprint.
EXPIRED
403
The license key or user subscription period has expired.
MAINTENANCE
503
The application has been placed in maintenance mode from panel settings.
VERSION_BLOCKED
426
The client executable version is outdated or blocked by update policy.
AUTH_MODE_MISMATCH
400
The endpoint called is not enabled for the application authentication mode.
INVALID_SELLER_KEY
401
The Seller Key header is missing or invalid.
INVALID_SELLER_SECRET
401
The Seller Secret header is missing or invalid.