Documentation

Developer Reference

API guides, integration examples, and SDK references for ZentryAuth.

Getting Started

Introduction

ZentryAuth provides high-performance authentication infrastructure built for developers, desktop software, and automated reseller networks. This guide walks you through authenticating client applications, distributing binaries securely, and integrating the Seller API.

💡
Base Endpoint: All API v1 requests should be sent over HTTPS to https://api.zentryauth.com/v1 using your application credentials.

Choose between three authentication architectures based on your product needs: License Key validation, User & Password logins, or Hybrid Key-Claiming.

Getting Started

Quick Start

Follow these core steps to initialize and validate software licenses in your client application.

1
Initialize Application
Fetch your APP_KEY from the ZentryAuth panel and configure your API base URL.
2
Activate & Bind HWID
Send the license key along with the client hardware ID (HWID) and version string.
3
Maintain Active Session
Store the returned session token and periodically validate it during execution.
bash
# Quickstart Activate Example
curl -X POST "https://api.zentryauth.com/v1/YOUR_APP_KEY/license/activate" \
  -H "Content-Type: application/json" \
  -d '{
    "key": "XXXX-XXXX-XXXX-XXXX",
    "hwid": "PC-HWID-9921",
    "version": "1.0.0"
  }'
⚠️
Security Warning: Always retrieve HWID directly from system APIs on the user machine. Never hardcode static HWIDs in production builds.
Getting Started

Authentication

Requests sent to ZentryAuth require standard HTTP headers and valid payload schemas.

Required Headers
http
Content-Type: application/json
Accept: application/json
Supported Authentication Modes
License Key User / Password Hybrid

Configure the mode of your application inside the panel settings. Endpoints enforce strict mode checks and return mode mismatch errors if called out of scope.

Core API

License Mode

Key-based authentication designed for instant software access, device locking, and automated expiration.

1. Init Check (Optional)
POST /v1/{app_key}/init

Checks if the app is active, in maintenance mode, or requires a version update.

Request
{
  "version": "1.0.0"
}
Response
{
  "success": true,
  "code": "OK",
  "data": {
    "app_name": "My Desktop App",
    "version": "1.0.0",
    "maintenance": false
  }
}
2. Activate License
POST /v1/{app_key}/license/activate

Validates key status, binds HWID on first use, and issues a session token.

Request
{
  "key": "XXXX-XXXX-XXXX-XXXX",
  "hwid": "PC-HWID-9921",
  "version": "1.0.0"
}
Response
{
  "success": true,
  "code": "OK",
  "data": {
    "token": "sess_88192a910...",
    "expires_at": "2026-12-31 23:59:59"
  }
}
Request Parameters
Parameter Type Required Description
key string Yes The license key issued by admin or reseller.
hwid string Yes Unique hardware fingerprint of client machine.
version string Yes Current version string of client executable.
3. Validate Session
POST /v1/{app_key}/license/validate

Verifies an active session token and client HWID binding.

Request
{
  "token": "sess_88192a910...",
  "hwid": "PC-HWID-9921",
  "version": "1.0.0"
}
Response
{
  "success": true,
  "code": "OK",
  "message": "Session valid"
}
Core API

User / Password Mode

Account-based authentication for applications requiring registered usernames, passwords, and custom user credentials.

POST /v1/{app_key}/user/login

Authenticates user credentials and checks active hardware bindings.

Request
{
  "login": "john_doe",
  "password": "secret123",
  "hwid": "PC-HWID-9921",
  "version": "1.0.0"
}
Response
{
  "success": true,
  "data": {
    "token": "sess_user_7712...",
    "username": "john_doe",
    "email": "john@example.com"
  }
}
Core API

Hybrid Mode

Combines key distribution with user creation. Claiming a key generates a user account instantly in one request.

💡
Hybrid Architecture: After executing /claim, the client authenticates using standard User/Password endpoints.
POST /v1/{app_key}/hybrid/claim

Claims an unassigned license key and registers a user account simultaneously.

Request
{
  "key": "XXXX-XXXX-XXXX-XXXX",
  "username": "john_doe",
  "password": "secret123",
  "email": "john@example.com",
  "hwid": "PC-HWID-9921"
}
Response
{
  "success": true,
  "code": "CLAIMED",
  "message": "Account created successfully"
}
Seller API

Seller API Overview

Server-to-server endpoints allowing Discord bots, external webshops, and automated billing tools to generate and manage keys without panel logins.

🔒
Server-Side Credentials: Never expose your Seller Key or Secret inside client software. Use them strictly on your backend server or Discord bot host.
Required Headers
http
X-Seller-Key: your_seller_key
X-Seller-Secret: your_seller_secret
Content-Type: application/json
Seller API

License Operations

Automate key generation, HWID resets, bans, and info lookups through server requests.

Create License
POST /seller/v1/licenses/create

Generates a new license key with custom duration, mask format, and prefix.

Request
{
  "duration_type": "days",
  "duration_value": 30,
  "key_prefix": "VIP"
}
Response
{
  "success": true,
  "data": {
    "license_key": "VIP-9812-7712-0091",
    "duration": "30 days"
  }
}
Request Parameters
Parameter Type Required Description
duration_type string Yes Duration unit: "days", "weeks", "months", or "lifetime".
duration_value integer Yes Numeric duration value (e.g. 7, 30, 90).
key_prefix string No Custom prefix string for generated key (e.g. "PRO").
Reset License HWID
POST /seller/v1/licenses/reset

Clears the bound hardware ID from a license, allowing the user to reactivate on a new device.

Request
{
  "license_key": "VIP-9812-7712-0091"
}
Response
{
  "success": true,
  "message": "HWID reset successfully"
}
Seller API

User Operations

Manage registered accounts, update passwords, and issue HWID resets remotely via API.

POST /seller/v1/users/create

Creates a new user account with specified duration and password.

Request
{
  "username": "jane_doe",
  "password": "secret123",
  "duration_days": 30
}
Response
{
  "success": true,
  "data": {
    "username": "jane_doe",
    "expires_at": "2026-08-20"
  }
}
Webhooks

Discord Webhook Automation

Automate recurring Discord announcements, branding, and status updates directly bound to your applications.

📡
Branding & Variables: Custom logos, banners, and embed colors can be set per webhook. Use dynamic variables like {user}, {app}, and {license} in message bodies.
File Distribution

Software Releases & Distribution

Publish DLLs, EXEs, and software installers safely. Uploaded files undergo SHA256 integrity verification and automated antivirus scanning.

Public Manifest Endpoint
GET /releases/{release_id}/manifest.json

Returns release metadata, version, file size, SHA256 checksum, and scan status.

Response
{
  "release_id": 102,
  "version": "1.0.4",
  "file_name": "Launcher-v1.0.4.exe",
  "size_bytes": 14820104,
  "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "scan_status": "clean"
}
Reference

Error Codes

Standardized response codes returned by ZentryAuth endpoints.

Code HTTP Status Description
INVALID_LICENSE 400 The key provided is invalid, unassigned, or malformed.
HWID_MISMATCH 403 The client HWID does not match the bound hardware fingerprint.
EXPIRED 403 The license key or user subscription period has expired.
MAINTENANCE 503 The application has been placed in maintenance mode from panel settings.
VERSION_BLOCKED 426 The client executable version is outdated or blocked by update policy.
AUTH_MODE_MISMATCH 400 The endpoint called is not enabled for the application authentication mode.
INVALID_SELLER_KEY 401 The Seller Key header is missing or invalid.
INVALID_SELLER_SECRET 401 The Seller Secret header is missing or invalid.
nloz jherry