API v1.4

Live on production — Enterprise subscription required. Hardened wire, session sequencing, compact payloads, and per-app security policy.

INFO

Availability: API v1.4 is enabled on this host. Only owners on the Enterprise plan (or admin override) can call /api/1.4/. All other plans use /api/1.3/.

Client API Enterprise

Built for production apps that need more than standard auth

Same endpoints you already use — init, login, license, check — with a hardened transport layer, smaller responses, and policy delivered directly to your client on session start.

Your API endpoint

https://libreauth.nutexe.dev/api/1.4/

Opaque wire v4 Request sequencing Compact JSON Build gate Per-app pepper Ed25519 signed

Why Upgrade to 1.4

Stronger wire layer

Opaque tokens bind every request to owner ID, app name, endpoint type, timestamp, and optional per-app pepper — harder to replay or forge than standard wire.

Session sequencing

Monotonic seq on every authenticated call stops out-of-order replays within an active session — your client stays in sync with the server.

Compact responses

Shorter JSON keys reduce payload size on every response — less bandwidth, faster parsing, cleaner logs in high-traffic clients.

Policy on init

sec_policy, changelog, and enabled features ship in one init response — your client adapts without hardcoding server rules.

Client build gate

Set a minimum build number in Panel — outdated clients are rejected silently. Force updates without exposing error details to crackers.

Per-app wire pepper

Unique pepper per application isolates wire secrets — compromising one app does not weaken others on the same platform.

Quick Start

Three steps from Enterprise subscription to your first 1.4 request.

Subscribe to Enterprise

Panel → Billing → choose Enterprise. See plan details.

Configure API 1.4

Panel → your app → Settings → API 1.4 card → set build, pepper, changelog → Save.

Point your client

Change base URL to https://libreauth.nutexe.dev/api/1.4/ and use an official SDK — wire auth, seq, and compact parsing are handled automatically.

INFO

Already on 1.3? Your integration knowledge transfers — same endpoints, same Ed25519 verification. See comparison and SDK guide.

Panel Configuration

Path: Panel → Application → Settings → API 1.4

`Min client build`

Integer build version your client must meet. Set 0 to disable enforcement.

Example: Panel = 10 → client sends client_build=10 or higher on every request.

`Wire pepper`

Per-app secret for opaque wire tokens. Click Generate, then Save settings. Leave empty for the platform default.

When active, init returns sp.per_app_pepper: true — embed the pepper in your client (obfuscated).

`Changelog`

Release notes text returned on init as compact key cl. Display in your loader or about screen.

Update whenever you ship — users see it without redeploying credentials.

Wire Authentication

Every 1.4 request uses opaque wire (la_v=4). The wire token is bound to owner ID, app name, endpoint type, timestamp, and optional per-app pepper — do not implement wire manually. Use an official Client SDK or extend your existing 1.3 integration; the SDK generates fresh wire credentials on every request.

Parameters your client sends

owneridYour 10-character owner ID

nameApplication name

typeEndpoint name — init, login, check, …

client_buildYour app build integer — required when panel minimum > 0

seqSession sequence — required after init

INFO

Wire fields (la_v, la_w, la_ts) are added automatically by the SDK. Custom HTTP clients should reuse SDK source as reference — the algorithm is not published here.

Request Flow

1 init

No seq. Get session, pubkey, sp policy, changelog.

→

2 login / license

seq=1 + sessionid + credentials + wire.

→

3 check / var / log

seq=2, 3, 4… increment after each success.

→

4 logout

Optional — end session when user exits.

Example — init

HTTP

POST /api/1.4/
Content-Type: application/x-www-form-urlencoded

type=init&name=MyApp&ownerid=ABCDEFGHIJ
&la_v=4&la_w=xxxxxxxxxxxxxxxxxxxxxxxx&la_ts=1717776000
&client_build=10&ver=1.0
&enckey=your35CharacterEncryptionKeyHere!!

Example — login (first call after init)

HTTP

POST /api/1.4/
Content-Type: application/x-www-form-urlencoded

type=login&name=MyApp&ownerid=ABCDEFGHIJ
&sessionid=FROM_INIT_RESPONSE
&username=user&pass=secret&hwid=HWID_HERE
&seq=1&client_build=10
&la_v=4&la_w=yyyyyyyyyyyyyyyyyyyyyyyy&la_ts=1717776010

Init Response

Successful init returns compact JSON. Expand keys in your client before use:

JSON — compact

{
  "s": 1,
  "m": "A7F3C291",
  "i": "session-id",
  "p": "ed25519_public_key_hex",
  "a": { "version": "1.0", "numUsers": "120", "numOnlineUsers": "8", "numKeys": "500" },
  "N": "response_nonce",
  "v": "1.4",
  "cl": "v2.1 — performance fixes",
  "sp": {
    "wire_min": 4,
    "min_client_build": 10,
    "seq_required": true,
    "per_app_pepper": true,
    "check_interval": 45,
    "strict_ip": true,
    "nonce_required": false
  },
  "ft": ["init", "login", "license", "check", "var", "log"],
  "cp": { "api_14": 1, "seller_api": 1, "team": 1 }
}

sec_policy (`sp`)

Init returns a compact policy object so your client can adapt at runtime — minimum build, heartbeat interval, pepper status, and enabled protections. Read each field from the init response and honor it in your client. Configure the underlying toggles in Panel → Settings → Access Controls.

Compact Response Keys

Map every 1.4 response through this table in your client:

Key	Full name	Description
`s`	success	`1` pass · `0` fail
`m`	message	Status code or error token
`i`	sessionid	Active session ID
`p`	pubkey	Ed25519 public key (init)
`a`	appinfo	Users, keys, version stats
`N`	nonce	Response nonce for chain
`o`	ownerid	Owner ID echo
`f`	info	User subscription data
`e`	enckey	Encryption key echo
`x`	newSession	`1` when session is new
`R`	response	Generic payload
`C`	contents	File or variable body
`V`	eventid	Webhook / loader event
`v`	api_version	`"1.4"`
`cl`	changelog	Panel changelog text
`sp`	sec_policy	Security policy object
`ft`	features	Enabled endpoint list
`cp`	capabilities	Your plan features

Request Sequence

After init, every authenticated call must include a monotonic seq counter. Start at 1 for the first post-init request and increment only after a successful response (s: 1). If a call fails, retry with the same seq — do not advance until the server accepts the request.

INFO

Official SDKs manage seq automatically. File download flows (Public vs Authenticated): Error Codes → File flow. Sequence errors: Quick Lookup.

Client Build Gate

Panel value	Client behavior	Result
`0`	`client_build` optional	Gate disabled
`10`	Send `client_build=10` or higher	Allowed
`10`	Send `client_build=9` or omit	Request rejected

TIP

Ship a new build → bump your client integer → raise panel minimum when ready to cut off old versions.

SDKs & 17 Languages

Official Client SDKs cover PHP, C++, C#, Python, Go, Rust, Java, Lua, JavaScript, TypeScript, React, Vue, Unity, WPF, VB.NET, Ruby, and Perl — all production-ready for API v1.3.

API v1.3 — ready now

All 17 SDKs work out of the box
Point to https://libreauth.nutexe.dev/api/1.3/
Full keys, standard wire — ideal for most apps

API v1.4 — extend your 1.3 client

Reuse signature + session logic from your 1.3 SDK
Add: URL /api/1.4/, wire v4, seq, compact expander
Same language, same patterns — one integration layer on top

INFO

Every language uses the same endpoint names. The 1.4 layer is a transport upgrade — not a new API surface. See Client Integration for setup examples.

API v1.3 vs v1.4

Feature	v1.3	v1.4
Plan required	Any plan	Enterprise only (live)
Endpoint URL	`/api/1.3/`	`/api/1.4/`
Wire	Standard or opaque	Opaque v4 (stronger)
Response size	Full JSON keys	Compact keys
Replay protection	Nonce chain (optional)	Nonce + mandatory `seq`
Policy in init	—	`sec_policy` + changelog
Force client updates	—	Build gate
Per-app wire secret	—	Wire pepper
Ed25519 signatures	✓	✓
AES response encryption	✓	✓

Go-Live Checklist

Enterprise activePanel → Billing shows Enterprise subscription

Panel API 1.4 savedMin build, wire pepper, changelog configured per app

Client URLhttps://libreauth.nutexe.dev/api/1.4/

Wire v4 workingSDK sends opaque wire on every request — test init + login succeed

Build gateclient_build sent when panel minimum > 0

Sequence counterStarts at 1 after init · increments on success only

Compact parserAll keys mapped — test init + login + check

Signatures verifiedEd25519 + optional AES via enckey — guide

INFO

API v1.4

Built for production apps that need more than standard auth

Why Upgrade to 1.4

Stronger wire layer

Session sequencing

Compact responses

Policy on init

Client build gate

Per-app wire pepper

Quick Start

Subscribe to Enterprise

Configure API 1.4

Point your client

Panel Configuration

Min client build

Wire pepper

Changelog

Wire Authentication

Parameters your client sends

Request Flow

Example — init

Example — login (first call after init)

Init Response

sec_policy (sp)

Compact Response Keys

Request Sequence

Client Build Gate

SDKs & 17 Languages

API v1.3 — ready now

API v1.4 — extend your 1.3 client

API v1.3 vs v1.4

Go-Live Checklist

`Min client build`

`Wire pepper`

`Changelog`

sec_policy (`sp`)