Key posted publicly
- Fifty machines try it.
- Device cap refuses the rest.
- Revoke, and every open session is refused.
Signed responses. A tamper-evident log. Proof, not promises.
RudeAuth is a hosted software licensing service. Your application embeds an SDK for C++, Go, C#, Python or Rust, and every response it receives is signed and verified before a single field is trusted.
No card. Free tier stays free.
The check every SDK makes before it trusts a reply, running in your browser. Change one number and watch it fail.
You get back a session or an error. There is no boolean to patch.
From sourcegithub.com/Rudevin17/rudeauth-cppC++17 static library
#include <rudeauth/rudeauth.hpp>
rudeauth::Client client(APP_ID, PUBLIC_KEY,
"https://api.rudeauth.com");
auto auth = client.authenticate(userKey);
if (!auth.ok()) return 1; // no bool to patch
auto session = auth.value();
go get github.com/Rudevin17/rudeauth-gosource
import "github.com/Rudevin17/rudeauth-go"
client, err := rudeauth.NewClient(appID, publicKey,
"https://api.rudeauth.com")
if err != nil { return err }
// sentinel errors, e.g. rudeauth.ErrLicenseExpired
sess, err := client.Authenticate(userKey)
if err != nil { return err }
defer sess.Close()
dotnet add package RudeAuthsource
using RudeAuth;
using var client = new RudeAuthClient(appId, publicKey,
"https://api.rudeauth.com");
// throws RudeAuthException on failure
using var session = client.Authenticate(userKey);
pip install rudeauthsource
from rudeauth import Client, RudeAuthError
client = Client(app_id, public_key, "https://api.rudeauth.com")
# raises RudeAuthError on failure
session = client.authenticate(user_key)
cargo add rudeauthsource
use rudeauth::Client;
let client = Client::new(app_id, public_key,
"https://api.rudeauth.com")?;
let session = client.authenticate(user_key)?;
Instead of false, a reason
Your application holds its own public key and checks every reply against it.
An example reply
{
"status": "active",
"license_expires_at": 1793404800,
"devices_used": 1,
"max_devices": 2
}
Expires 31 October 2026.
Signature
wuuHZOEZ48ukG8Ly271NXcV1YW3q8kDxYzKfR2RShbS30B3b92cpANuGLo5IDVMFXSecAPNeb4/XQmu479Z1DQ==
Public key
2zjnrvAZzOmv4CxecoFj9acvcaR4hfJLqnz59pwKN7U=
The check runs in your browser when JavaScript is on.
A demo key made for this page, so the reply is an example rather than anyone's licence.
What gets signed is rudeauth-v1:handshake: followed by the
SHA-256 of the body, which is exactly what the SDKs check.
How verification works
Discord. No card, no sales call.
It gets its own signing identity. Copy two values.
C++, Go, C#, Python or Rust. Public and MIT.
Keys are looked up by digest and sealed under a master key that lives outside the database. Every response that carries an entitlement is signed before it leaves.
Ed25519, checked before parsing. A rewritten reply fails.
Keys are stored as keyed hashes, and the secret is kept outside the database. A dump is digests.
Enough of a machine's parts have to match, not all. New disk still works. New machine doesn't.
Each entry hashes the last. Edit one and the chain breaks.
Encrypted under that session's key, so a copy from one machine won't open on another. Nothing to patch: the bytes aren't there until we send them.
Three things that actually happen, and what the service does about each.
Not an obfuscator. We can't stop someone editing your binary, only make sure the valuable parts live here. Pair it with a packer if you need one.
Paying buys room and features. It never buys a better signature.
Free forever. No card.
or $59 a year, save 30%
$59 billed yearly
Sign in with Discord, then upgrade in Settings.
For higher-volume vendors. Pricing when it opens.
For higher-volume vendors. Pricing when it opens.
or write to support@rudeauth.com
Only if it returns a boolean. Ours doesn't. A failed redeem yields no session, and gated files stay encrypted server-side.
New sessions fail; existing ones run to expiry. That's the honest cost of server-side validation.
Don't. Verify the signatures and read the audit chain. That's the point.
New, and not yet third-party audited. Every SDK checks its cryptography against the same published test vectors, so you can run them yourself. Read the vectors or the SDKs.