Q&A

Frequently asked questions about integrating LibreAuth.

API & SDKs

Which API version does LibreAuth use?

Supported client API versions: v1.3 (/api/1.3/, all plans) and v1.4 (/api/1.4/, Enterprise only — live). Both require wire-authenticated SDK clients.

API v1.4 adds seq, compact responses, and per-app policy — see API v1.4.

What does E18 mean?

Client sent a request without a valid wire token. Use an official LibreAuth SDK on /api/1.3/ or /api/1.4/. See Wire / E18 troubleshooting.

What is API 1.4 min client build?

Panel setting under Settings → API 1.4. Value 0 = off. Value 1+ = client must send client_build ≥ that number on every request. See Client Build Gate.

Which plans include Seller API or API 1.4?

Billing Plans — Seller API: Pro+. API 1.4 and Protocol v2: Enterprise only. Free/Developer/Pro: Client API 1.2 / 1.3. Protocol v2 is optional — 1.x stays fully supported. Seller API works with apps that use Protocol v2 clients (management wire is separate from /api/v2/ HMAC).

Panel shows license success but the client cannot log in?

Server already accepted the key (licensesuccess / Discord log). The client failed decrypting the Protocol v2 AEAD reply (X-LA-Enc: aead, 16-byte IV). Rebuild with the current SDK — C# needs BouncyCastle.Cryptography (.NET AesGcm only accepts 12-byte nonces). See API Protocol v2 → AEAD.

Do all 17 SDK languages support API 1.4?

All 17 SDKs work with API v1.3 today. API 1.4 uses the same endpoints but needs extra client code (wire v4, seq, compact responses) — extend your existing 1.3 integration; it is not a one-line URL swap. Details: API 1.4 → SDKs.

How do I connect my client?

See Client Integration — set your API URL, app name, and owner ID in any official SDK.

Can one key be Full (all functions) and another Lite?

Yes. Create two Subscriptions — Full = All functions, Lite = whitelist เช่น loader. Bind the key to that pack. After login the client gets info.features / all_features. Use SDK HasFeature — do not string-compare pack names. Guide: Subscriptions & Features.

Which SDKs are included?

LibreAuth ships built-in clients for C#, C++, Python, PHP, JavaScript, TypeScript, Java, Go, Rust, Ruby, Perl, Lua, React, Vue, Unity, WPF, and VB.NET — see Client SDKs.

Do I need external libraries?

No — copy the SDK source for your language. Set API URL, app name, and ownerid.

Where do I get name and ownerid?

Panel → Manage Apps: secret name + Owner ID (10 chars). Both are required on every API call. Display labels that differ from the secret name will Ghost on init.

Init fails with HTTP 404 Ghost / Ghost/WAF?

On init, unsigned 404 almost always means name+ownerid do not match an enabled app — not Cloudflare. Fix credentials; keep Panel SELECT APP identical. Guide: API v2 → Ghost · Troubleshooting.

Panel features

How do client logs work?

Call SDK log() or API type log. Messages appear in Panel → Event Logs (max 255 chars). See Logging & Integration.

What is Web Loader?

Users press buttons on Customer Panel Remote tab; your desktop app receives the value via LoaderWait(). See Web Loader.

How do I send Discord notifications?

App → Discord Alerts → Add webhook → paste URL → ติ๊ก Events ที่ต้องการ (แยกห้องได้). Details in Logging guide · Routing.

What does error code E1A7FF8 mean?

Session not authenticated — ไฟล์ตั้ง Authenticated แต่ client ยังไม่ license/login. แก้: license ก่อน file หรือเปลี่ยนไฟล์เป็น Public. ดู Error Codes.

What does E1AA3B2 mean?

Invalid sequence on API v1.4 — ส่ง seq ผิด. ใช้ SDK ล่าสุดและดู Request Sequence.

How do I download files from the API?

type=file + fileid + sessionid. Public files: init → file. Authenticated: init → license → file. Full guide: File Download flows.

What is Operations / Remote Shell?

Remote workspace for an online, HWID-bound licensed client: browse drives/files, upload from your PC (Publish), capture the screen, edit text files, run files, and use a Windows PowerShell/cmd terminal. The server only queues — the client executes. Full guide: Operations · Workspace tabs.

What are Operations Places (Desktop / Downloads / …)?

One-click shortcuts on the Operations rail. They accept tokens like {downloads}, then queue %USERPROFILE%\Downloads so older Windows clients can expand env vars. Rebuild the device SDK only if Places still returns not a directory after a panel hard-refresh. Guide: Places · sdk/OPS_PLACES.md.

Do I need WSL or Git Bash for Operations?

No. Stock Windows only — powershell.exe / cmd.exe. See Windows engines.

How does Publish Update work now?

Pick a file on your machine and a Windows path on the device (e.g. C:\App\update.zip). The panel queues shell_upload (max 2 MiB). For larger CDN builds use Advanced → URL deploy_update.

What shell commands work on the device?

Native Windows / PowerShell. Aliases: ls→dir, etc. Paths must be Windows absolute. Examples: Operations examples.

Why does type=var fail with Session not authenticated?

Global variables are never public. Need init → license/login (active sub + bound HWID) then type=var. Init-only is blocked. Guide: Variables gate · API v2 → Variables.

Can Variables be Public like Files?

No. Panel / Seller always force authed=1. Files still support Public vs Authenticated; variables do not.

What does Block AI Assist Tools cover?

Hardening scans AI agents and local LLMs (Cursor, Windsurf, Hermes Agent, Continue, Cline, Ollama, LM Studio, …) via exact exe + install path + window title when Panel block_ai is ON. Dev escape: LA_ALLOW_AI=1. Details: Access Controls · sdk/protect/ANTI_AI.md.

Why does my Operations command queue but never run?

Rebuild with current SDK (OpsBridge / process_check_ops), poll type=check, and ack with device_sig + result_enc=b64. WAIT = never pulled (hwid / check loop). SENT = pulled but never acked (missing ProcessCheckOps, no device key, WAF on plaintext paths, or oversized capture → Result too large). Client exits immediately with Cursor/Hermes open → turn block_ai OFF for that machine or set LA_ALLOW_AI=1 (AI needles only via Hardening block_ai). See handoff · troubleshooting · sdk/PROTOCOL_V2.md.

Support

Errors: Error Codes (E01–E18 + dynamic) · Troubleshooting · API reference: All Endpoints