API Protocol v2

Enterprise only — server issues session secrets, clients verify Ed25519, and Operations run on signed envelopes. API 1.2 / 1.3 / 1.4 stay fully supported.

INFO

Availability: Protocol v2 requires the Enterprise plan (api_v2). Non-Enterprise calls get HTTP 403. Everyone else keeps using /api/1.2/–/api/1.4/.

Client API Enterprise

Authority stays on the server — clients only transport and verify

No shared wire pepper in the SDK. Session secret comes from init. Every follow-up call carries nonce, monotonic seq, and HMAC mac. Responses are Ed25519-signed; SDKs fail closed if the signature is missing.

Your API endpoint

https://libreauth.nutexe.dev/api/v2/

Session secret HMAC request MAC Strict nonce + seq Ed25519 verify AEAD (iv16) Signed ops

Why Protocol v2

No client-held pepper

SDKs ship with public app id / ownerid and Ed25519 public key only — nothing that grants API privilege by itself.

Fail-closed crypto

Missing nonce, seq, mac, or response signature → reject. No omit-bypass.

Signed Operations

check may return a signed ops envelope — clients verify before execute; opsack needs a device signature.

1.x stays open

Free / Developer / Pro / Enterprise keep API 1.2–1.4. v2 is an Enterprise upgrade path, not a forced cutover.

Quick Start

Enterprise plan

Panel → Billing → Enterprise. Hub Plans must have Protocol v2 enabled on the tier.

Pick a v2 SDK

Copy LibreAuthV2 from the SDK Portal (login + Developer / Pro / Enterprise for View/Download) or docs SDKs. C++ sendable pack: C++ Pack.

Point URL

Use https://libreauth.nutexe.dev/api/v2/ — call Init() then Login / License. If Hash Check is on for the app, pass the exe MD5: Init($md5).

Request MAC

After init, every request must include session, ts, nonce, seq, and mac.

Canonical string

POST
/api/v2/
2.0
{sha256(body_json)}
{session}
{ts}
{nonce}
{seq}

mac = HMAC-SHA256(canonical, session_secret) as lowercase hex. Response headers X-Signature-Timestamp + X-Signature-Ed25519 must verify against the server public key.

AEAD response body

When the session has a stored sess_secret, authenticated replies may include X-LA-Enc: aead.

Wire: base64(iv16 || tag16 || ciphertext)
Key: SHA256("la2aead|" + session_secret) (32 raw bytes)
Cipher: AES-256-GCM with 16-byte IV (OpenSSL / C++ / PHP). .NET AesGcm only accepts 12 — use BouncyCastle.Cryptography in C#.

WARN

Verify Ed25519 headers on the raw body first, then decrypt. Panel licensesuccess with client AEAD decrypt failed means an outdated C# / incomplete SDK — not a bad license key.

Sequence after login / license

init → client starts at seq = 0
login / license sends seq = 1; server rotates session and returns "seq": 0
Client must adopt that value (ForceAdopt). If seq is missing (legacy), adopt 1
Next check sends adopted + 1

Client increments before the HTTP call; server bumps only after MAC OK. On unsigned Ghost/WAF 404 or pre-bump Fail, roll client seq back.

Request Flow

init (+ optional device_pubkey, optional hash) → session, session_secret, pubkey, policy
login / license with MAC + hwid → rotated session + seq: 0
check / var / opsack with MAC + same hwid
AEAD body when X-LA-Enc: aead

Operations Envelope

On authenticated check, the server may attach a signed ops object (payload, sig, raw). Verify Ed25519 before execute. Ack with opsack + device_sig from the enrolled device key (enroll via device_pubkey on init). Send the same hwid on every check/opsack so bound_hwid matches the panel target.

Official SDKs

Language	v2 source	Docs
PHP	`LibreAuthV2.php`	Setup
C#	`LibreAuthV2.cs`	Setup
Python	`libreauth_v2.py`	Setup
JavaScript	`libreauth-v2.js`	Setup · BFF for browsers
Go / Java / Rust / Ruby / Perl / Lua	`PROTOCOL_V2.md` + language ports in portal
React / Vue	BFF only — React · Vue

PHP

require 'LibreAuthV2.php';
$app = new LibreAuthV2('AppName', 'OWNER_ID_10', 'https://libreauth.nutexe.dev/api/v2/');
$app->Init(); // or Init($exeMd5) when Hash Check is on
$app->Login('user', 'pass', 'HWID');

Seller API + Protocol v2

Seller API (/seller-api/, sellerkey) is orthogonal to Protocol v2. It already manages apps whose clients call /api/v2/. Seller wire stays JSON + Bearer — not HMAC. See Seller API. type=info returns capabilities.api_v2.

Protocol comparison

	1.3	1.4	v2
Plan	All	Enterprise	Enterprise
Endpoint	`/api/1.3/`	`/api/1.4/`	`/api/v2/`
Client pepper	Yes (wire)	Yes (opaque)	No
Session secret	—	—	Server-issued
Request MAC	—	—	HMAC required
Still supported	Yes	Yes	Yes (Enterprise)

INFO

Related: Billing Plans · API 1.4 · Client SDKs · Response Signing · SDK Portal