Authentication

All API requests authenticate with the project’s key, sent as the X-Project-Key header.

X-Project-Key: pk-...

The dashboard exposes three project values. Know which is which:

Value	Secret?	Where it’s used
Project ID	No	Identifying the project in responses and URLs.
Project Key (`pk-...`)	No	Authenticates API calls. Embed in the client script.
Public Signing Key	No	Verifies `key/check` signatures. Safe to embed in the client.
Signing private key	Yes	Signs `key/check` responses. Server-only, never exposed.

What is and isn’t secret

The Project Key is a public API key, not a bearer secret. It exists so the API knows which project you are calling. It is designed to ship inside the script — the script cannot call key/check without it, so it has to be there. An attacker who extracts the Project Key from a script gains nothing:

They still need a valid, unexpired license key whose HWID matches — key/check returns an error otherwise.
The Project Key cannot issue keys, revoke keys, or modify the project.
It cannot forge responses. Forging requires the signing private key.

The one value that must never leak is the signing private key. It lives only on the server, signs every key/check response, and is not exposed by any endpoint. The Public Signing Key is the only crypto material that ships to the client — the script uses it to verify, never to sign.

Rate limits

Endpoint	Limit
`key/check`	120 requests / 60s per IP
`hwid/reset`	60 requests / 60s per IP

Exceeding a limit returns 429 with retry_after.

⌘I