Security Practices

Harden your client application when integrating LibreAuth.

Client-side

• Obfuscate API URL, app name, owner ID (LibreAuth Protect L1 + xorstr / custom XOR)
• Verify response signatures before trusting JSON
• Send exe hash on init when hash check is enabled
• Call check() periodically to detect session hijack
• Do not store license keys in plain text on disk
• Never expose Application Secret in client binaries — use Ed25519 public key only

Wire security

• Always use HTTPS
• Enable signature verification — see Response Signing
• Send 35-char enckey on init for AES-encrypted responses
• Send HWID on login and license when HWID lock is enabled
• Send cpu and pcuser on login so admins can identify machines — Users & Machines
• Ban repeat offenders with scoped machine ban — HWID Bans · panel guide

API v1.4 wire

• Enterprise plan required — /api/1.4/ returns 404 for other plans
• Use opaque wire on /api/1.4/ — handled by official SDK
• If per-app pepper is set, embed it obfuscated in the client — see Panel Configuration
• Implement seq counter — increment only after successful responses
• Parse compact response keys (s, m, i, …) — see mapping table

Server checklist

• Rotate api.wire_pepper in config — see /health.php security_advisory
• Set trusted_proxies when behind Cloudflare or nginx
• Enable Redis for distributed rate limits
• Turnstile on panel + customer login (Hub → Platform)
• Per-app wire pepper for API 1.4 apps
• Enterprise integrations may opt into Protocol v2 (/api/v2/) — no client-held pepper; API 1.x remains supported
• Run php scripts/security-audit.php --html after deploy