Sessions & Live Control

What a session is

After License::Login or Account::Login, the server opens a row keyed by the session token returned to the client. The row carries the user id, app id, HWID, sign-in IP, sign-in country, sign-in timestamp, last-heartbeat timestamp, and the executable hash bound at login.

The client holds the token for the life of the process. The DLL runs its own heartbeat in the background - 5 s poll for account sessions, persistent socket for license sessions. The heartbeat is the channel the dashboard uses to issue commands.

The heartbeat is the channel

Heartbeats are the same authenticated round-trip that proves integrity. The server reads back any pending commands and closes the round-trip. There is no extra round-trip, no long-poll, no socket beyond the encrypted one already in use.

Atlas::Network::CheckAuthentication() is for explicit checkpoints before a sensitive action - it does not replace the background loop.

// Poll the server. true while the session is valid.
if (!Atlas::Network::CheckAuthentication()) {
    // Session was revoked, license became invalid, or the server asked
    // the SDK to end the process. The session state is now closed.
    return 1;
}

Message a live session

From the dashboard: Monitor → Message. Type the body (256 characters max) and send. The next heartbeat delivers it and the client shows it in a Windows MessageBox. Delivered once - the SDK does not persist it.

Common uses:

• Announce a forced upgrade window.
• Notify the user their payment failed and the session ends in 24 h.
• Send a one-time legal or compliance banner.

Force-logout

From the dashboard: Monitor → Kill. The session row flips, the client reads it on the next heartbeat, the SDK stops the heartbeat, calls Logout, and the example process exits within about five seconds (per the C++ SDK README).

Use it for refund cancellations, TOS violations, expired subscriptions. The session row closes; the license is untouched.

Ban a user

From the dashboard: Bans. Marks the user banned; current sessions end; future logins return Banned. Permanent unless the ban was created with a duration; remove it from Bans to lift it.

All three bindings also expose Atlas::Network::BanUser(reason, duration_minutes) for self-ban from the running client (user-initiated account closure, etc). duration_minutes = 0 means permanent.

Timeouts

• Heartbeat grace - the server drops a session whose last heartbeat is more than 30 seconds old. A couple of missed beats from a network hiccup still survive.
• Session timeout - a hard cap on session length, measured from session start, not last activity. Off by default; choose 15 minutes to 7 days under Settings → Sign-in rules. A session that reaches the cap is ended like a Monitor kill and the user re-authenticates.
• Token expiry - session tokens are not JWTs. They live until logout, a kill, the session timeout, or a fresh login replacing them.