Skip to content

Licensing you can actually verify.

Signed responses. A tamper-evident log. Proof, not promises.

RudeAuth is a hosted software licensing service. Your application embeds an SDK for C++, Go, C#, Python or Rust, and every response it receives is signed and verified before a single field is trusted.

C++GoC#PythonRustMIT

No card. Free tier stays free.

AUDIT LOGENCRYPTED FILESRUDEAUTH APIR5 / 5 PARTS1 / 5 PARTSFINGERPRINTLICENCE KEYSAPPLICATIONCLIENT MACHINESUNKNOWN MACHINE

Check it yourself.

The check every SDK makes before it trusts a reply, running in your browser. Change one number and watch it fail.

Your side: one call

You get back a session or an error. There is no boolean to patch.

From sourcegithub.com/Rudevin17/rudeauth-cppC++17 static library

#include <rudeauth/rudeauth.hpp>

rudeauth::Client client(APP_ID, PUBLIC_KEY,
                        "https://api.rudeauth.com");

auto auth = client.authenticate(userKey);
if (!auth.ok()) return 1;          // no bool to patch
auto session = auth.value();

go get github.com/Rudevin17/rudeauth-gosource

import "github.com/Rudevin17/rudeauth-go"

client, err := rudeauth.NewClient(appID, publicKey,
    "https://api.rudeauth.com")
if err != nil { return err }

// sentinel errors, e.g. rudeauth.ErrLicenseExpired
sess, err := client.Authenticate(userKey)
if err != nil { return err }
defer sess.Close()

dotnet add package RudeAuthsource

using RudeAuth;

using var client = new RudeAuthClient(appId, publicKey,
    "https://api.rudeauth.com");

// throws RudeAuthException on failure
using var session = client.Authenticate(userKey);

pip install rudeauthsource

from rudeauth import Client, RudeAuthError

client = Client(app_id, public_key, "https://api.rudeauth.com")
# raises RudeAuthError on failure
session = client.authenticate(user_key)

cargo add rudeauthsource

use rudeauth::Client;

let client = Client::new(app_id, public_key,
    "https://api.rudeauth.com")?;
let session = client.authenticate(user_key)?;

Instead of false, a reason

LICENSE_EXPIRED
Past its expiry, by our clock rather than the machine's.
DEVICE_LIMIT
Already bound to as many machines as the licence allows.
DEVICE_BLACKLISTED
A banned part or address.
LICENSE_INVALID
Unknown, revoked or banned. It never says which, so nobody can probe for keys that exist.
Every error code

Our side: a signed reply

Your application holds its own public key and checks every reply against it.

An example reply

{
  "status": "active",
  "license_expires_at": 1793404800,
  "devices_used": 1,
  "max_devices": 2
}

Expires 31 October 2026.

Signature

wuuHZOEZ48ukG8Ly271NXcV1YW3q8kDxYzKfR2RShbS30B3b92cpANuGLo5IDVMFXSecAPNeb4/XQmu479Z1DQ==

Public key

2zjnrvAZzOmv4CxecoFj9acvcaR4hfJLqnz59pwKN7U=

The check runs in your browser when JavaScript is on.

A demo key made for this page, so the reply is an example rather than anyone's licence. What gets signed is rudeauth-v1:handshake: followed by the SHA-256 of the body, which is exactly what the SDKs check. How verification works

Live in three steps.

01

Sign in

Discord. No card, no sales call.

02

Create an app

It gets its own signing identity. Copy two values.

03

Drop in the SDK

C++, Go, C#, Python or Rust. Public and MIT.

A stolen database holds no usable keys.

Keys are looked up by digest and sealed under a master key that lives outside the database. Every response that carries an entitlement is signed before it leaves.

Signed responses

Ed25519, checked before parsing. A rewritten reply fails.

Nothing reusable at rest

Keys are stored as keyed hashes, and the secret is kept outside the database. A dump is digests.

Binding that survives a swap

Enough of a machine's parts have to match, not all. New disk still works. New machine doesn't.

Tamper-evident log

Each entry hashes the last. Edit one and the chain breaks.

Files resealed per session

Encrypted under that session's key, so a copy from one machine won't open on another. Nothing to patch: the bytes aren't there until we send them.

When someone tries.

Three things that actually happen, and what the service does about each.

Key posted publicly

  • Fifty machines try it.
  • Device cap refuses the rest.
  • Revoke, and every open session is refused.

Banned machine fakes a part

  • One part changed to dodge the ban.
  • Still recognised as the same machine.
  • Bans are per part, so they stick.

Clock rolled back

  • System time set to last year.
  • Expiry is ours, not theirs.
  • Refused anyway.

What this isn't

Not an obfuscator. We can't stop someone editing your binary, only make sure the valuable parts live here. Pair it with a packer if you need one.

Every plan is signed, bound and logged.

Paying buys room and features. It never buys a better signature.

Free

$0

Free forever. No card.

  • 1 application
  • 100 licences
  • Signing and device binding
  • Audit log
Start free with Discord

Scale

Coming soon

For higher-volume vendors. Pricing when it opens.

Coming soon

For higher-volume vendors. Pricing when it opens.

  • Everything in Pro
  • Unlimited licences
  • Management API
Get early access

or write to support@rudeauth.com

Fair questions.

Can't they just patch the check?

Only if it returns a boolean. Ours doesn't. A failed redeem yields no session, and gated files stay encrypted server-side.

What if you go down?

New sessions fail; existing ones run to expiry. That's the honest cost of server-side validation.

Why trust you?

Don't. Verify the signatures and read the audit chain. That's the point.

Is it production ready?

New, and not yet third-party audited. Every SDK checks its cryptography against the same published test vectors, so you can run them yourself. Read the vectors or the SDKs.

Ship it this week.

Start free with Discord