# RudeAuth

> RudeAuth is a hosted software licensing service. Your application embeds an application id and an Ed25519 public key; every server response is signed and verified against that key before any field is trusted, so a patched binary, a proxy, or a hosts-file redirect cannot fake a successful licence check.

Base URL: https://api.rudeauth.com. Dashboard: https://app.rudeauth.com. Docs: https://docs.rudeauth.com. RudeAuth is a licensing service, not a user-identity or password authentication provider.

## Integration rules (read before writing any code)

Follow these. They are not style preferences; breaking them removes the protection the SDK exists to provide.

- No `bool is_licensed()`. `authenticate()` returns a Session or an error; the gated calls exist only on a Session. Pass the Session to the code that needs it, never a boolean.
- Embed the application id and the public key in the binary. Both are safe to embed. Never read the public key from a config file an attacker could swap.
- Verify before trust. The SDK verifies the signature over the raw response bytes before parsing anything. If you write your own client, never parse first and verify second.
- No offline mode and no "last known good" cache. If the server is unreachable, calls fail. A cache is exactly what an attacker induces by blocking the network.
- Gate real logic, not a splash screen. Move code or data the program genuinely needs into a server-delivered file or variable, so it cannot function without a valid licence.
- Rotate anything you rely on. A variable protects only while it changes faster than someone maintains a patch. Do not hardcode one "just for testing"; it ships.
- Honest limits: device binding deters casual sharing; fingerprints are forgeable. Do not describe this as unbreakable.

Check your work with `rudeauth-cli review ./src`. It runs locally, needs no key or network, and exits non-zero when it finds one of the patterns above. It matches patterns rather than parsing, so a clean run is not proof the integration is sound.

## SDKs

- [Go SDK](https://github.com/Rudevin17/rudeauth-go): install with `go get github.com/Rudevin17/rudeauth-go`
- [Python SDK](https://github.com/Rudevin17/rudeauth-python): install with `pip install rudeauth`
- [C# SDK](https://github.com/Rudevin17/rudeauth-csharp): install with `dotnet add package RudeAuth`
- [Rust SDK](https://github.com/Rudevin17/rudeauth-rust): install with `cargo add rudeauth`
- [C++ SDK](https://github.com/Rudevin17/rudeauth-cpp): Windows, C++17 static library, built from source

## Docs

- [Quickstart](https://docs.rudeauth.com/#start): create an application, generate licence keys, integrate an SDK, verify it refuses
- [How verification works](https://docs.rudeauth.com/#model): signed responses, device binding, replay protection, session keys
- [Verifying a response](https://docs.rudeauth.com/#envelope): the signed envelope, and why you verify the raw bytes before parsing
- [Handshake](https://docs.rudeauth.com/#handshake): POST /v1/handshake, redeem a key, bind the device, open a session
- [Heartbeat](https://docs.rudeauth.com/#heartbeat): POST /v1/heartbeat, confirm and extend a session
- [Variables](https://docs.rudeauth.com/#variables): POST /v1/variables, sealed server-side values
- [Files](https://docs.rudeauth.com/#files): POST /v1/files, encrypted payloads that never shipped in the binary
- [Webhook events](https://docs.rudeauth.com/#webhook): license.redeemed, device.bound, device.reset, license.banned, license.expired, sharing.flagged. Bodies carry ids and counts, never keys or tokens. At-least-once, so handlers must be idempotent
- [Device reset](https://docs.rudeauth.com/#reset): POST /v1/device/reset, let a customer unbind their own devices
- [Webhook](https://docs.rudeauth.com/#webhook): POST /v1/webhook, call a configured endpoint through RudeAuth
- [Error codes](https://docs.rudeauth.com/#errors): the signed error codes and what the client should do for each
- [Device fingerprints](https://docs.rudeauth.com/#fingerprint): K-of-N matching, hashed components, choosing good components
- [Rate limits](https://docs.rudeauth.com/#limits): per application and per source address

## Full

- [Full documentation as markdown](https://docs.rudeauth.com/llms-full.txt): everything above in one file