Developer API Overview

The AuthForge Developer API lets you manage licenses programmatically from your own backend. Use it to create licenses after Stripe payments, revoke access, manage variables, configure webhooks, and more.

Base URL

https://api.authforge.cc/v1/

All endpoints are prefixed with /v1/.

Authentication

Every request must include your API key in the Authorization header as a Bearer token:

Authorization: Bearer af_live_your_key_here

API keys are created in the Dashboard under Settings → API Keys. Keys are prefixed with af_live_ for identification. Each key is scoped to your account and can manage licenses across all of your applications; the target app is specified per-request via the appId field or URL parameter.

API keys are shown only once when created. Store them securely. If compromised, delete the key in the dashboard and create a new one.

Rate limits

Limit	Value
Per key	120 requests/minute and 3,000 requests/hour
Per account	300 requests/minute across all of the account’s keys
Keys per account	25 unexpired keys, dashboard and device pairing combined
Webhook changes	60 creates, edits and deletes per hour per account
Webhook tests	10 per 10 minutes per account
Burst (whole API)	100 requests/second
Sustained (whole API)	50 requests/second

If you exceed a rate limit, you’ll receive HTTP 429 with the Developer API error shape (error + message) and a Retry-After header. Back off and retry with exponential backoff. Public SDK endpoints on auth.authforge.cc (/auth/validate, /auth/heartbeat, /auth/selfban, /auth/offline/activate) use different limits and a different JSON body on failure: { "status": "failed", "error": "rate_limited" }. /auth/validate has extra per-IP and per-license application limits; /auth/heartbeat has a per-license limit (6/min, applied per device for unlimited-seat licenses) but no per-IP limit; /auth/offline/activate allows 10/min per IP and 3/min per license key. See Error Codes Reference.

Credits

License management calls (create, list, update, delete, variables, webhooks, security) do not consume credits. Two things do: SDK authentication (1 credit per successful validate, 1 per 10 heartbeats) and minting an offline license file via POST /v1/licenses/{licenseKey}/offline-files (1 credit per successful mint, debited from the app owner’s balance; rejected mints are free). Self-serve offline activation costs 2 credits per new machine (one validation plus one mint), charged to the app owner when the end user’s app calls POST /auth/offline/activate; activating the same machine again and every refusal are free. A refund or chargeback revokes the license online but cannot reach files already issued. For a lifetime file, that means the buyer keeps the app. See Managing Credits for details.

Response format

All responses return JSON. Successful responses include the requested data directly:

{
  "licenses": [...],
  "cursor": null
}

Error responses include an error code and a human-readable message:

{
  "error": "not_found",
  "message": "Resource not found"
}

Pagination

List endpoints use cursor-based pagination. If more results are available, the response includes a cursor value. Pass it as a query parameter in the next request:

# First page
curl "https://api.authforge.cc/v1/licenses?appId=YOUR_APP_ID&limit=100" \
  -H "Authorization: Bearer af_live_your_key"

# Next page
curl "https://api.authforge.cc/v1/licenses?appId=YOUR_APP_ID&limit=100&cursor=eyJsaW..." \
  -H "Authorization: Bearer af_live_your_key"

When cursor is null, you’ve reached the last page.

Endpoints

Licenses

Method	Path	Description
POST	`/v1/licenses`	Create one or more licenses
GET	`/v1/licenses`	List licenses for an app
GET	`/v1/licenses/:licenseKey`	Get a single license
PUT	`/v1/licenses/:licenseKey`	Revoke, activate, extend, or reset HWID
DELETE	`/v1/licenses/:licenseKey`	Permanently delete a license
POST	`/v1/licenses/:licenseKey/offline-files`	Mint an offline license file (1 credit)
GET	`/v1/licenses/:licenseKey/offline-files`	Offline file mint history
GET	`/v1/licenses/:licenseKey/offline-machines`	Machines holding a self-serve lifetime file
DELETE	`/v1/licenses/:licenseKey/offline-machines/:hwidHash`	Release a self-serve offline machine

Apps

Method	Path	Description
PUT	`/v1/apps/:appId`	Turn self-serve offline activation on or off; set credit burn caps

Variables

Method	Path	Description
GET	`/v1/apps/:appId/variables`	Get app variables
PUT	`/v1/apps/:appId/variables`	Set app variables
GET	`/v1/licenses/:licenseKey/variables`	Get license variables
PUT	`/v1/licenses/:licenseKey/variables`	Set license variables

Webhooks

Method	Path	Description
POST	`/v1/apps/:appId/webhooks`	Create a webhook
GET	`/v1/apps/:appId/webhooks`	List webhooks
PUT	`/v1/apps/:appId/webhooks/:webhookId`	Update a webhook
DELETE	`/v1/apps/:appId/webhooks/:webhookId`	Delete a webhook
POST	`/v1/apps/:appId/webhooks/:webhookId/test`	Send a test event

Security

Method	Path	Description
GET	`/v1/apps/:appId/security`	Get security config
PUT	`/v1/apps/:appId/security`	Update security config
POST	`/v1/apps/:appId/security/blacklist`	Add to blacklist
DELETE	`/v1/apps/:appId/security/blacklist`	Remove from blacklist
POST	`/v1/apps/:appId/security/whitelist`	Add to whitelist
DELETE	`/v1/apps/:appId/security/whitelist`	Remove from whitelist

Error codes

See the Error Codes Reference for a complete list of error codes across all endpoints.

​Base URL

​Authentication

​Rate limits

​Credits

​Response format

​Pagination

​Endpoints

​Licenses

​Apps

​Variables

​Webhooks

​Security

​Error codes

Base URL

Authentication

Rate limits

Credits

Response format

Pagination

Endpoints

Licenses

Apps

Variables

Webhooks

Security

Error codes