Atheryx integration guide

Overview

Atheryx protects your software with license-key generation, hardware-ID binding, and secure server-side session validation. Your application talks to the Atheryx REST API; the SDKs wrap these calls so you never deal with raw requests.

The flow is simple: initialize your app with your application ID and secret, authenticate your user with a username and password (optionally bound to a HWID), and validate licenses before unlocking features.

Quick Start

The first endpoint is POST /api/v1.1/init. It opens a session for your application and returns the token your app will send with every request after.

{
  "owner_id": "your-owner-id",
  "app_name": "My Application",
  "version": "1.0.0",
  "secret": "your-app-secret",
  "hash": "optional-instance-hash",
  "hwid": "hardware-id"
}

Sessions expire after 7 days of active use or 72 hours of inactivity — whichever comes first. Your SDK re-initializes automatically when a session expires.

Authentication

Authenticate your users with the POST /api/v1.1/login endpoint. It requires an active session token, verifies the credentials with bcrypt, and optionally binds the account to a hardware ID.

{
  "session_id": "session-token-from-init",
  "username": "johndoe",
  "password": "correct horse battery staple",
  "hwid": "optional-hardware-id",
  "ip": "optional-ip-address"
}

• •Passwords are hashed with bcrypt — plaintext is never stored.
• •If a HWID is supplied and the account has a HWID already, they must match; otherwise the request is rejected.
• •The response returns a short-lived token plus the user's licenses, roles, and tags.
• •Register new users via POST /api/v1.1/register.

Licenses

Generate keys from the dashboard or programmatically via POST /api/v1.1/licenses. Each license carries a level, optional expiry, and a status. Validate a license before unlocking paid features:

• •Levels map to tiers (USER, VIP, PREMIUM, ADMIN).
• •Expired licenses return LIC_EXPIRED — design your UX to prompt renewal.
• •Revoke or suspend instantly from the dashboard; changes take effect on the next validation.
• •HWID-reset requests you approve unlock the key for a new machine.

Tags & Permissions

Tags are feature-level permissions independent of roles. Assign a tag like BETA_ACCESS to specific users to unlock preview features, or a plan tag to gate content. Your client checks tags from the authenticated session — no license regeneration required.

Webhooks

Atheryx can push real-time events to your endpoints (or a Discord channel) whenever something important happens — a login, license activation, or HWID reset. Events are delivered with retries and a delivery log you can inspect in the dashboard. Configure webhook URLs under your application settings.

Errors

API errors return a stable error code in the JSON body so your client can react without parsing messages. Common codes: