Docs / API / Access Controls Access Controls
Every toggle in Panel → Application → Settings → Access Controls — what it does, when to use it, and what your client must send.
Panel path
Select an application → Settings tab → Access Controls card. Changes apply per application — not global.
11 toggles
Per-app
Instant effect
Overview
Presets
Flow
Status
HWID
HWID Bans
Users & Machines
Network
Integrity
Toggle
DB field
Affects
Client action
App Status enabledinitNone — server rejects when off HWID Lock hwid_locklogin · license · register Send stable hwid Force HWID force_hwidlogin · license · register hwid required (non-empty)Block VPNs block_vpnAuthenticated requests None — IP checked server-side Block Emulators block_emulatorAll API types except logout/log/webhook Real device HWID — no emulator or fake API signals Hash Check hash_checkinitSend exe MD5 as hash Anti-Tamper integrity_guardSession after init Same IP/HWID · no replay Nonce Chain anti_replayRequests after init Echo nonce from prior response Bind Session IP strict_ipSession requests Same public IP throughout session Token File Check token_file_checkinitSend token + thash (C++) App Paused pausedinitNone — maintenance mode
TIP
Official LibreAuth SDKs handle wire auth, nonce, and signatures automatically. Custom clients (raw HTTP or third-party forks) must implement each requirement manually — see
Client Integration .
Game / Tool
Maximum protection
Hash Check ON + whitelist MD5 in Settings → Config → Hash Management
HWID Lock + Force HWID ON
Block Emulators ON
Anti-Tamper ON
Block VPNs — optional (may block legit mobile users)
Nonce Chain — ON if using custom SDK
Desktop SaaS
Balanced
HWID Lock ON · Force HWID off unless needed
Anti-Tamper ON
Hash Check — optional for native builds
Bind Session IP — off if users change networks often
Development
Testing only
Keep Hash Check / Token File / Nonce OFF
Block VPNs & Emulators OFF
Enable protections one-by-one before release
1 App Status Master on/off — disabled apps reject init
→
2 App Paused Maintenance — users see pause message
→
3 init Hash · Token File · Emulator checks run here
→
4 login / license HWID · VPN · Emulator · Force HWID
→
5 Session Anti-Tamper · Nonce · Bind IP on every call
App Status Core enabledServer only
Master switch for the application. When disabled, every init request fails immediately — existing sessions may still work until they expire.
When to enable Disable to fully shut down an app without deleting data. Use when migrating, investigating abuse, or sunsetting a product.
Client requirements No extra parameters — failure is server-side. Response: Application disabled (custom message supported in panel). Errors E16App disabled — enable in panel or contact seller
App Paused Core pausedServer only
Temporary maintenance mode. Blocks new init calls while keeping the app record and settings intact. Different from App Status — paused apps show a user-facing maintenance message.
When to enable Deploying updates, database maintenance, or pausing sales temporarily. Toggle off when ready to accept logins again.
Client requirements No client changes — users see: Application is currently paused… Existing sessions are not automatically killed — combine with session kill if needed. Errors E17App paused — wait for developer to unpause
HWID Lock Security hwid_lockClient + Server
Binds each user account to a hardware ID. First successful login stores the HWID — subsequent logins from a different machine are rejected until reset.
When to enable Desktop tools, game cheats, or any license you want locked to one PC. Always pair with a real HWID generator in your client.
Client requirements Send the same hwid string on login, license, register, and check. C++: la_guard::Hwid() from hardening.hpp . Reset via panel Users tab or Seller API resethwid. Errors HWID mismatchUser bound to another machine — reset HWID or use correct device
Force HWID Security force_hwidClient required
Requires a non-empty hwid on every login and license call. Works alongside HWID Lock — blocks clients that send blank HWIDs to bypass binding.
When to enable Enable when HWID Lock is on and you want zero tolerance for missing HWID. Keep off during early development if your client does not send HWID yet.
Client requirements Must send hwid with minimum length (configurable via min_hwid in panel). Empty or missing HWID → Force HWID is enabled… Errors Force HWID…Send hwid or disable Force HWID in panel
Block VPNs Advanced block_vpnServer only
Rejects requests from IP addresses identified as VPN, proxy, or hosting/datacenter ranges. Checked on all authenticated API calls (not on bare init).
When to enable Reduce fraud, multi-account abuse, and geo-evasion. Avoid on mobile-heavy apps where carrier NAT and VPN overlap.
Client requirements No client parameters — server inspects client IP. Behind Cloudflare: ensure server reads CF-Connecting-IP correctly. Users on legitimate VPN see: VPNs are blocked on this application. Errors VPN blockedDisable VPN or turn off Block VPNs in panel for testing
Block Emulators Security block_emulatorClient + Server
Unified emulator guard — Android/iOS AVD, BlueStacks, Nox, LDPlayer, WSA, fake local API servers, VM signals, suspicious HWID, loopback clients.
When to enable Any app that must run on real hardware only. Also blocks fake local auth servers. Default is ON for new apps.
Client requirements Use real device fingerprints from physical hardware. Server scans hwid, device fields, headers, client IP, and fake-API markers on every protected request. C++ clients: call la_guard::RunChecks() before init — detects emulator processes, hosts redirect, local ports. Errors Emulator blockedRun on real hardware or disable for dev builds only
Hash Check Security hash_checkClient required
Validates the client executable MD5 against a server whitelist on every init. Even a one-byte patch changes the hash and blocks access.
When to enable Native C++ / C# builds distributed as binaries. Add hash after each release build (especially after obfuscation).
Client requirements Send 32-char MD5 hex on init as hash, h, or x. C++: la_guard::ExeMd5Hex() — compute after SecureLoader seal / final obfuscation. Add hash in Panel → Settings → Config → Hash Management or Seller API addhash. On E05: check received_hash (rh on 1.4) in response or Panel → Settings → Recent rejected MD5 . Errors E04Hash required — send MD5 on init
E05Hash mismatch — add MD5 from response rh to whitelist
E48E0A5Not a hash error — Invalid license key after init succeeded
Anti-Tamper Security integrity_guardClient + Server
Master session integrity layer. Enables duplicate-request blocking, optional IP binding, HWID session lock, and Token File validation when that sub-toggle is on.
When to enable Production apps using LibreAuth SDK or a custom client that sends consistent HWID and respects session rules. Default ON .
Client requirements Send identical hwid on every request after login. Do not replay captured requests in rapid succession. Sub-toggles (Nonce Chain, Bind Session IP, Token File) only apply when Anti-Tamper is ON. Errors E10Session IP mismatch — Bind Session IP is on
E12Duplicate request — wait before retrying the same payload
E13HWID session mismatch — hwid changed mid-session
Nonce Chain Advanced anti_replayClient required
Challenge-response chain: each API response includes a nonce. The next request must echo that exact nonce. Prevents simple request replay from packet captures.
When to enable Custom SDKs or high-value targets. Official LibreAuth SDKs send nonce automatically. Enable only when your client implements it.
Client requirements Store nonce from every response. Send it as nonce on the next request (before server issues a new one). Missing or wrong nonce → Invalid nonce / E11. Errors E11Send nonce from previous response on every request
Bind Session IP Advanced strict_ipServer + Network
Session is locked to the IP address recorded at init. If the user's public IP changes mid-session (mobile handoff, VPN toggle), subsequent calls fail.
When to enable Fixed-desktop environments. Disable for mobile users, CGNAT, or Cloudflare setups where IP may appear to change.
Client requirements No extra fields — server compares current IP to session IP. Requires stable client IP detection on server (see Cloudflare / reverse proxy config). Errors E10Session IP mismatch — reconnect from same network
Token File Check Advanced token_file_checkC++ client
Token file validation on init. Client sends integrity token + MD5 of token.dat. Server verifies against configured token hash.
When to enable C++ loaders using token.dat sidecar files. Set Token File Hash in panel Settings when enabling.
Client requirements On init: send thash = MD5 of token.dat (32 hex). Send token per SDK / panel integration guide. Requires Anti-Tamper ON (integrity_guard). Errors E06Token Must Be Provided
E07Hash Must Be Provided (thash)
E08Token file hash mismatch
E09Invalid token signature
INFO
Custom messages for any error can be set in Panel → Settings → Custom Messages. Wire error codes (E04, E10, …) are documented in
Anti-Tamper .