Control who can use your software.
NineAuth provides server-side authentication, license management, and access control for desktop applications, game launchers, developer tools, and SaaS — keeping sensitive authorization logic off the client.
import { NineAuthClient } from "@nineauth/sdk";
// 1. Initialize client for registered application
const client = await NineAuthClient.initialize({
applicationId: "app_9f81a3d4e8b2",
environment: "production"
});
// 2. Authenticate user & bind device fingerprint
await client.login({
email: "alex@company.com",
password: "••••••••••••",
deviceFingerprint: "hwid-mac-8c1645729a"
});
// 3. Zero client authorization logic.
// Entitlements are evaluated in-memory with real-time server invalidation.
if (client.hasEntitlement("pro_features")) {
startProtectedApp();
}How NineAuth Protects Your Software
Verify user identity against server-side infrastructure without storing credentials locally.
Lock license activation to the physical device with configurable seat limits.
Evaluate feature permissions in real time without recompiling or redeploying binaries.
Invalidate compromised access across all devices in milliseconds from the console.
Built for software that ships to real users
Designed for teams who need reliable access control without building custom auth backends.
Desktop Applications
C#, Rust, Electron, and C++ native binaries requiring hardware locking and secure runtime authorization.
Game Launchers & Tools
Anti-tamper protection, concurrent seat limits, and automated hardware ID reset quotas.
Commercial Developer Tools
IDEs, automation utilities, CAD plugins, and trading algorithms with tiered feature licensing.
On-Premises & Self-Hosted
Air-gapped verification, custom seat management, and signed license tokens for enterprise deployments.
Three core capabilities. One unified platform.
Authenticate without building auth backends
Multi-tenant tenant isolation with state-of-the-art Argon2id hashing and opaque 15-minute access tokens.
- ›Argon2id with memory-hard cost parameters
- ›Brute-force protection & sliding rate limiters
- ›Tokens stored as SHA-256 hashes at rest
Control exactly what each user can access
Decouple feature flags from compiled client code with real-time server-side evaluation.
- ›In-memory cached client checks with live invalidation
- ›Server-evaluated tier upgrades without binary updates
- ›Custom JSON metadata payloads per license
Revoke compromised access instantly
Lock software execution to physical hardware fingerprints and revoke compromised sessions instantaneously.
- ›Configurable seat limits (1 to 100+ seats)
- ›Automated self-service HWID reset quotas
- ›Sub-100ms cascade token purging across all devices
Integrate in minutes with type-safe SDKs.
The official NineAuth client SDK handles session tokens in-memory, automatic anti-replay signing, and real-time entitlement checks with full TypeScript definitions.
import { NineAuthClient } from "@nineauth/sdk";
// Initialize client with application identifier
const client = await NineAuthClient.initialize({
applicationId: "app_live_8a7d16f4",
environment: "production"
});
// Activate license with hardware device binding
const activation = await client.activateLicense({
licenseKey: "PRO-90FA-41B8-Z71C",
deviceFingerprint: "hwid-mac-8c1645729a"
});
// Real-time server-side entitlement validation
const canExecute = await client.checkEntitlement("pro_features");
if (canExecute) {
startAppRuntime();
}Real engineering guarantees. No marketing badges.
We never claim a client binary is 100% uncrackable. We provide rock-solid, tamper-evident server-side licensing infrastructure so cracked client checks can never compromise your server resources.
Instant Cascade Revocation
When an application, plan, or license is revoked in the management console, all active sessions and refresh tokens are immediately invalidated across all devices in milliseconds.
Opaque 256-Bit Tokens
No sensitive claims or user privileges in JWT payloads. Tokens are 256-bit cryptographically random strings stored as SHA-256 hashes in PostgreSQL.
HMAC-Signed Webhooks
Receive real-time notifications on license activations, expirations, and cancellations with cryptographic HMAC-SHA256 signatures and 5-stage backoff retries.
Append-Only Audit Trail
Every login failure, license creation, activation, and hardware reset is logged to an immutable audit ledger with client IP addresses and actor classifications.
Stop building licensing infrastructure from scratch.
Protect your software, manage licenses, and control access with NineAuth. Start for free in 30 seconds — no credit card required.