Users & Machines
Track every PC that logs in — HWID, CPU, PC name, IP geolocation, and scoped machine bans from the panel.
Panel path
Select an application → sidebar Users → user card → Machines button. Click a row for full hardware and network details.
What It Does
LibreAuth records each unique HWID per user in the user_devices table when the client authenticates (login, license, or register). The panel merges this with session data and the user’s bound HWID so you see every machine tied to an account — including multiple PCs on one license key.
- Machines button on each user card — opens a wide table (Machine, CPU, IP, Last seen)
- Row click — full HWID, hardware metadata, timestamps, and detailed IP lookup (country, ISP, proxy/VPN flags)
- Online tag — active session with matching
bound_hwid - License key peers — when one key has multiple users, each account has View machines
cpu and pcuser on login for readable machine names in the table. HWID alone works, but the CPU column shows — until metadata is sent.Using the Panel
Machines table
| Column | Source |
|---|---|
| Machine | pcuser / PC name, else truncated HWID. Sub-line shows short HWID. |
| CPU | cpu from last login with that HWID |
| IP | Last seen IP for that device record or session |
| Last seen | Latest of last_seen, last_login, or active session time |
Machine detail view
- Hardware ID — copy or Ban machine (pick ban scope: HWID only, Machine, or Machine + keys)
- Machine — PC name, CPU, OS, optional
device/model/manufacturerfrom client - Timestamps — First seen, Last seen, Last login
- Network — IP geolocation via panel
ip_info(country, region, city, ISP, ASN, reverse DNS, mobile/proxy/hosting flags)
User search
The Users search box matches username, license key, HWID, CPU, PC name, and IP from stored devices — useful when investigating abuse without opening each card.
Client Fields (login / license / register)
All fields are optional except hwid when Force HWID is enabled. Sent on the same POST as authentication:
| Parameter | Stored as | Notes |
|---|---|---|
hwid | Device key | Required for HWID Lock and machine bans |
cpu | user_devices.cpu | CPU model string, max 255 chars |
pcuser | user_devices.pc_name | Windows username or hostname (aliases: hostname, computername) |
os / platform | user_devices.os_name | OS label |
device, model, manufacturer, hardware, product, brand, board, fingerprint | meta_json | Shown in machine detail when present |
POST https://libreauth.nutexe.dev/api/1.3/type=login
name=MyApp
ownerid=XXXXXXXXXX
sessionid=...
username=user123
pass=secret
hwid=c93a25c9aae4b2f44d631077a...
cpu=Intel(R) Core(TM) i7-9700K CPU @ 3.60GHz
pcuser=DESKTOP-GAME
os=Windows 11API reference: login · license · register
Database & Upgrade
Device rows live in user_devices (schema revision 11). Run install/upgrade.php once on existing installs if the table is missing — the panel still shows HWIDs from users.hwid and sessions without it, but CPU/PC metadata is only persisted when the table exists.
Each row is unique per (app_id, user_id, hwid). Updates on every login refresh last_seen, last_login, IP, and metadata when the client sends new values.
Finding Machines Before a Ban
| Scenario | Where to look |
|---|---|
| Known username | Users → card → Machines |
| Shared license key | Users card → users on this license key → View machines per account |
| Active session only | Sessions → Bound HWID column |
| Quick ban | HWID Bans → Quick ban from user chips |
Ban Machine from Detail
Ban machine in the detail modal (or from HWID Bans) calls AppCore::BanMachine() with the scope you select:
| Scope | What is blocked |
|---|---|
| HWID only | HWID blacklist only — safe when VM and host share the same public IP |
| Machine | HWID + every IP ever tied to that HWID + session kill |
| Machine + license key(s) | Machine scope + bans license keys used on that PC |
Panel bans do not change the user’s Banned badge in Users — ban the account separately if needed. Toast example: HWID blocked · 2 IPs · sessions killed.
UnbanMachine() — clears HWID, related IPs, and reverses key bans. See HWID Bans → Unban.Troubleshooting
| Issue | Fix |
|---|---|
| No machines listed | User never logged in with HWID — enable Force HWID |
| CPU / PC name empty | Client not sending cpu / pcuser — add to login request |
| IP geolocation unavailable | Panel uses ip-api.com with Redis cache; private or invalid IPs show limited data |
| Same PC, multiple rows | HWID changed (spoof/reset) — each distinct HWID is a separate device row |