Authorization that holds under active attack.

Licensing for Windows x64 software. Keys and accounts locked to the machine, a session you can end in seconds, and a check that keeps running for as long as the app does.

Start free Read the docs

Free tier, no card. SDKs for C++, JavaScript and Python.

Dashboard / Meridian / Global activitySample data
8
live sessions
  • 14:02:30SUCCESSAuthentication successful.
  • 14:02:27SUCCESSAuthentication successful.
  • 14:02:24DENYAuthentication denied - VPN/proxy detected.
  • 14:02:21SUCCESSAuthentication successful.
  • Checked the whole session. Integrity checks re-run every few seconds, not only at sign-in.
  • Approvals are signed. A cracked or faked server cannot say yes.
  • Updates itself. Apps that load Atlas.dll replace it with the newest release at launch.
  • Refused before the key. A banned machine, an unauthorized build or a VPN is turned away before a key is even read.
16,178
authentications verified
2,028
licenses issued
1,184
sign-ins refused, threats prevented, attacks blocked
99.76%
platform uptime

What it enforces

Six layers. A request that fails one fails the whole login. Every request runs the same stack in the same order, cheapest check first.

  1. 01

    Transport

    Every packet carries a fresh nonce and a keyed tag, every request derives its own keys from the machine and the build, and a proof-of-work gate runs before any license logic. A replayed request has no window to land in.

    Beats
    Interception, replay, floods
  2. 02

    Identity

    Sixteen hardware sources, each kept on its own, so changing one never clears a ban on the rest.

    Beats
    Spoofing one component
  3. 03

    Session

    The session id is kept encrypted in memory. The auth token is derived from the live session and the machine, then split across four separate fragments that all have to be right at once. Flip one value and nothing opens.

    Beats
    Cheat Engine, boolean patching
  4. 04

    Client integrity

    Debugger, hook, injection and hardware-breakpoint detection, import-table and code checks, threads hidden from debuggers, two threads watching each other. All of it runs for the life of the process, not only at login.

    Beats
    x64dbg, WinDbg, IDA, Frida
  5. 05

    Server proof

    Every approval is signed over the client’s own nonce, the license and the session. A fake server cannot say yes, and the client exits on a missing signature, with no fallback and no retry.

    Beats
    Nulled and cracked servers
  6. 06

    Server rules

    Executable-hash whitelist, VPN and proxy checks, per-IP rate limits and session caps, served from an in-memory cache the dashboard invalidates the instant you change anything.

    Beats
    Patched builds, abuse, sharing

Two paths in

Sell a key, or run a full account system. Same SDK. Every app supports both flows. You choose per app which one your end users see; the protections around them are identical.

Ship a key. Bind on first use.

The first login binds the key to the machine. The server refuses on expiry, a ban, a hardware change or an address outside your rules, and logs which one.

main.cpp
Atlas::API_KEY = "YOUR_API_KEY";
Atlas::Startup();
if (!Atlas::License::Login(key)) return 1;
 
// a signed heartbeat now runs in the background
Atlas::Network::CheckAuthentication();

Usernames, passwords and time credit.

Accounts locked to the machine, email verification on the events you choose, password reset, and time credit that carries across keys. No mail server to run: Atlas queues, sends and renders every message.

main.cpp
using Status = Atlas::Account::LoginResult::Status;
auto r = Atlas::Account::Login(user, pass);
 
if (r.status == Status::NeedsVerification) {
    // 8-digit code emailed to r.masked_email
    Atlas::Account::SubmitVerification(code);
}
Dashboard / Meridian / LicensesSample data
Meridian
Licenses
LicenseStatus
ATLAS-7F2C-91B8-E04DActive
ATLAS-2B90-C5E1-7A36Active
ATLAS-C41D-08E6-B2A7Unused
ATLAS-91AF-3D07-5C28Paused
ATLAS-E560-A1B4-F903Expired

A key binds to the first machine that signs in.

Hardware identity

Spoof one. We catch the rest. A fingerprint is sixteen values, each kept on its own. Change one component and the fingerprint shifts, but every other component is still on the ban list.

Illustration / one machine's hardware fingerprintSample data
HWIDAtlas-Kq3vT9mXw2LpR7dYcN8zUa
16 / 16components still match the banned machine

Banned machine recognized.

Choose any component to change it. Values here are placeholders.

Dashboard / Meridian / BansSample data
TypeTargetExpires
LicenseATLAS-7F2C-91B8-E04DNever
HWIDAtlas-Kq3vT9mXw2LpR7dYcN8zUaNever
IP203.0.113.5530 days
Email[email protected]Never

One ban covers the license, the hardware, the IP and, for accounts, the email address.

Rules engine

Banned machines, patched builds and VPNs never reach the license check. Cheapest checks first, and the first one that trips ends the request. Country rules, seat caps and hardware locks follow.

Dashboard / Meridian / Request logsSample data

Every denial is logged with the rule that caused it.

01Cracked builds die at the door
The server checks the SHA-256 of the connecting executable against your whitelist before a session exists. A patched, repacked or cracked copy has a different hash and never gets one.
02Rules that act on their own
A rule trips and Atlas bans the license, the hardware and the IP together, and can queue an email or post to your Discord. Nobody has to be watching.
03A leaked key stops being shared
Cap how many machines can run one license at once. The second copy is refused the moment it connects.
04Datacenter and VPN traffic refused
Each address is checked for proxy and VPN use and the verdict is cached for up to six hours, so real users pay nothing for it.
05Limits you set per app
Hardware and address binding, tight or loose, and country allow and block lists.

Server-side secrets

Secrets stay on the server. Keep anything valuable in server variables and files. They are served only to a live, verified session, so a cracked client still has nothing to read.

main.cpp
std::string url = Atlas::Variables::Fetch("update_url");
auto blob = Atlas::Network::Download(2);
Dashboard / Meridian / VariablesSample data
KeyValueSession
update_urlhttps://cdn.meridian.example/builds/latestYes
feature_flags{"beta": true, "telemetry": false}Yes
min_version2.4.0Yes
support_urlhttps://help.meridian.exampleNo

Updates

Ship a patch. Everyone runs it. Builds you have not authorized cannot sign in, so an old or modified copy stops working when you promote the next one.

  1. 01

    Upload

    Add the new build in the dashboard. Atlas computes its SHA-256.

  2. 02

    Promote

    Make it the current version, or pause one that should stop reaching users.

  3. 03

    Clients update

    Running clients fetch it at Startup, verify the SHA-256, swap the executable and relaunch.

  4. 04

    The library updates too

    The Atlas library can swap its own DLL under a live JavaScript or Python host, so a fix to the library reaches running apps without a manual step.

Two products, one answer

Authenticator secures the license. Obfuscator secures the file the license check runs in. Every rule, ban and signed reply holds up against someone who never opens a debugger. Against someone who does, what matters is whether the binary can be read at all.

What Authenticator already does

Hardware-locked keys, signed server replies, bans and build checks that run before the license is looked up, a session you can end live. The full licensing layer.

What only Obfuscator can do

No license logic survives being read in a decompiler. Obfuscator turns the compiled file itself into noise, so the checks Authenticator makes are never sitting there in plain sight to begin with.

See what Obfuscator protects

License software that fights back.

Free tier. No card. Put a build in your own tools and try to break it.

Get started See plans
  • Free to start, no card
  • SDK for C++, JavaScript and Python
  • Windows x64