Application Management & Configuration#
In AuthVaultix, an Application functions like an isolated security workspace. Each application has its own dedicated database storing user accounts, license keys, remote variables, security policies, custom domains, and audit logs.
Application Credentials & Parameters#
When you create a new application in the AuthVaultix Dashboard, these four main identifiers are set:| Credential Name | Storage Type | Immutable? | Description |
|---|
| Application Name | String | No | Your software's display name (3 to 40 characters). |
| Owner ID | String (10-char Hex) | Yes | The account owner's unique 10-character identifier. |
| App Secret | String (64-char Hex) | Can Rotate | A 256-bit secret key for HMAC-SHA256 response signing. |
| Version | String (e.g. 1.0) | No | Software version string verified during client initialization. |
Creating a New Application#
To register a new application:1.
Go to the Applications page in the Dashboard.
2.
Click the Create Application button.
3.
Enter a name that follows these validation rules:Character length must be between 3 and 40 characters.
Allowed characters: Letters (a-z, A-Z), Numbers (0-9), Spaces ( ), Hyphens (-), and Underscores (_).
4.
(Optional) Add an internal note.
Automatically generates a 64-character hexadecimal App Secret.
Creates a default subscription tier named default (Level 1).
Syncs your account's configured global custom domain with the new app.
Overview & Core Settings#
The Overview Tab provides the main application management controls and logging settings:1. General Settings#
Application Name & Version: Update the application's display name or increment the version.
Discord Webhook URL: Add a Discord webhook URL (https://canary.discord.com/api/webhooks/... or discord.com) to receive real-time alerts for client logins, license redemptions, and security violations.
Notes: Save admin-visible notes.
2. Secret Key Rotation#
If your Application Secret is leaked, click the Rotate Secret button. The system immediately generates a new 64-character hex key.[!CAUTION]
Rotating the App Secret prevents old compiled client executables from connecting until they are recompiled with the new secret key.
💡 Recommendation: Release an updated client version before rotating the secret to avoid unnecessary connection failures for existing users.
3. Application Pause / Resume State#
Use the Pause Application toggle to temporarily disable the application.When the application is paused, all Client API requests return status code 409 (APP_PAUSED).
Active user sessions are temporarily blocked until the app is resumed.
4. Executable Hash Reset#
If Client Executable Hash Checking is enabled, AuthVaultix locks the client's SHA-256 binary hash. When releasing a new build, click the Reset Hash button to clear the previously stored hash.5. Granular Event Logging Toggles#
You can choose which client telemetry fields to log in the dashboard:Username & Application Name
Client IP Address, City, Country, Region, Timezone, and ISP
VPN / Proxy Detection Status
Client Machine Hardware ID (HWID)
License Key & Subscription Expiry
Software Version & Account Creation Timestamp
Security & Hardening Controls#
The Security Settings panel lets you configure hardware locking, VPN blocking, and session management:| Security Feature | Options | Default | Description |
|---|
| Application Status | Enabled / Disabled | Enabled | Main switch to enable or disable all client API communications. |
| HWID Lock | Enabled / Disabled | Enabled | Locks the user account and license key to the first authenticated machine HWID. |
| Force HWID | Enabled / Disabled | Disabled | Rejects authentication if the client SDK does not send a hardware ID. |
| VPN & Proxy Block | Enabled / Disabled | Disabled | Blocks connections from commercial VPNs, TOR exit nodes, and proxies. |
| Hash Check | Enabled / Disabled | Disabled | Verifies the client executable SHA-256 hash against the approved server hash. |
| Block Leaked Passwords | Enabled / Disabled | Disabled | Checks passwords against known breach databases and blocks weak passwords. |
| Token Validation | Disabled / User Level / Application Level / All Levels | Disabled | Requires a valid dashboard authorization token during client login. |
| HWID Reset Interval | Unit (Days, Hours) & Duration | 7 Days | Cooldown duration before an automated HWID reset can be requested. |
| Session Expiry | Unit (Hours, Days) & Duration | 6 Hours | Duration after which an active client session key expires and re-authentication is required. |
[!NOTE]
Token Validation Levels: User Level verifies only individual user authorization tokens, while Application Level verifies application-wide authorization tokens. All Levels enforces both validations.
Feature & API Endpoint Controls (Client Functions)#
In the Functions Tab, you can individually enable or disable specific client API endpoints. All 20 features are divided into 5 categories:1. Authentication#
| Function Name | Description |
|---|
login | User authentication with username and password. |
register | Creation of a new user account. |
license | Login or registration using only license key redemption. |
upgrade | Upgrade an existing account by redeeming a license key. |
2. Data Management#
| Function Name | Description |
|---|
get_user_var | Access user-specific remote variables. |
set_user_var | Store user-specific remote data. |
get_global_var | Retrieve application-wide global data for all users of the selected app. |
3. Chat Functions#
| Function Name | Description |
|---|
send_message | Send real-time in-app messages to users. |
get_messages | Retrieve messages sent by users. |
4. Security & Moderation#
| Function Name | Description |
|---|
ban | Ban users for security violations or bannable events. |
blacklist_check | Check whether a user is blacklisted from the application. |
session_check | Verify session validity (background heartbeat). |
twofa | Two-Factor Authentication (2FA) verification. |
5. Utilities#
| Function Name | Description |
|---|
change_username | Modify an existing user's username. |
file_download | In-memory encrypted file streaming and download functionality. |
online_users | Fetch the count and list of currently active/online users. |
forgot_password | Password reset and OTP verification functionality. |
fetch_stats | Retrieve application statistics and user usage data. |
logs | Application event logging system. |
webhooks | Application webhooks functionality. |
Seller API Endpoint Controls (Seller Functions)#
For administrative REST API endpoints (/api/seller/), you can enable or disable individual API endpoints in the Seller Functions tab:1. User Management#
| API Action | Description |
|---|
ban_user | Enable/disable the Ban User API endpoint. |
change_password | Enable/disable the Change Password API endpoint. |
change_username | Enable/disable the Change Username API endpoint. |
change_user_email | Enable/disable the Change User Email API endpoint. |
create_user | Enable/disable the Create User API endpoint. |
delete_all_users | Enable/disable the Delete All Users API endpoint. |
delete_expired_users | Enable/disable the Delete Expired Users API endpoint. |
delete_user | Enable/disable the Delete User API endpoint. |
extend_user_expiry | Enable/disable the Extend User Expiry API endpoint. |
get_usernames | Enable/disable the Get Usernames API endpoint. |
pause_user | Enable/disable the Pause User API endpoint. |
retrieve_users | Enable/disable the Retrieve Users API endpoint. |
retrieve_user_data | Enable/disable the Retrieve User Data API endpoint. |
subtract_time | Enable/disable the Subtract Time API endpoint. |
unban_user | Enable/disable the Unban User API endpoint. |
unpause_user | Enable/disable the Unpause User API endpoint. |
user_exists | Enable/disable the User Exists API endpoint. |
2. HWID Management#
| API Action | Description |
|---|
add_hwid | Enable/disable the Add HWID API endpoint. |
reset_all_hwid | Enable/disable the Reset All HWID API endpoint. |
reset_hwid | Enable/disable the Reset HWID API endpoint. |
3. Licenses & Keys#
| API Action | Description |
|---|
retrieve_license_from_user | Enable/disable the Retrieve License From User API endpoint. |
create_license | Enable/disable the Create License API endpoint. |
delete_all_unused | Enable/disable the Delete All Unused Licenses API endpoint. |
delete_all_used | Enable/disable the Delete All Used Licenses API endpoint. |
delete_license | Enable/disable the Delete License API endpoint. |
delete_used | Enable/disable the Delete Used License API endpoint. |
export_keys | Enable/disable the Export Keys API endpoint. |
export_unused | Enable/disable the Export Unused Keys API endpoint. |
export_used | Enable/disable the Export Used Keys API endpoint. |
extend_expiry | Enable/disable the Extend Expiry API endpoint. |
license_info | Enable/disable the License Info API endpoint. |
set_note | Enable/disable the Set Note API endpoint. |
unused_keys | Enable/disable the Unused Keys API endpoint. |
used_keys | Enable/disable the Used Keys API endpoint. |
verify_license | Enable/disable the Verify License API endpoint. |
4. Subscriptions#
| API Action | Description |
|---|
retrieve_user_subscriptions | Enable/disable the Retrieve User Subscriptions API endpoint. |
change_subscription | Enable/disable the Change Subscription API endpoint. |
create_subscription | Enable/disable the Create Subscription API endpoint. |
delete_subscription | Enable/disable the Delete Subscription API endpoint. |
edit_subscription | Enable/disable the Edit Subscription API endpoint. |
get_subscriptions | Enable/disable the Get Subscriptions API endpoint. |
pause_subscription | Enable/disable the Pause Subscription API endpoint. |
unpause_subscription | Enable/disable the Unpause Subscription API endpoint. |
5. Variables#
| API Action | Description |
|---|
delete_all_user_variables | Enable/disable the Delete All User Variables API endpoint. |
delete_user_variable | Enable/disable the Delete User Variable API endpoint. |
delete_variables_by_name | Enable/disable the Delete Variables By Name API endpoint. |
edit_user_variable | Enable/disable the Edit User Variable API endpoint. |
global_create | Enable/disable the Global Create Variable API endpoint. |
global_delete | Enable/disable the Global Delete Variable API endpoint. |
global_delete_all | Enable/disable the Global Delete All Variables API endpoint. |
global_edit | Enable/disable the Global Edit Variable API endpoint. |
global_get | Enable/disable the Global Get Variable API endpoint. |
global_get_all | Enable/disable the Global Get All Variables API endpoint. |
retrieve_all_user_variables | Enable/disable the Retrieve All User Variables API endpoint. |
retrieve_user_variable | Enable/disable the Retrieve User Variable API endpoint. |
set_user_variable | Enable/disable the Set User Variable API endpoint. |
6. Resellers & Managers#
| API Action | Description |
|---|
manager_delete | Enable/disable the Manager Delete API endpoint. |
manager_list | Enable/disable the Manager List API endpoint. |
reseller_create | Enable/disable the Reseller Create API endpoint. |
reseller_delete | Enable/disable the Reseller Delete API endpoint. |
reseller_edit | Enable/disable the Reseller Edit API endpoint. |
reseller_get | Enable/disable the Reseller Get API endpoint. |
reseller_get_all | Enable/disable the Reseller Get All API endpoint. |
7. Session Management#
| API Action | Description |
|---|
sessions_end_all | Enable/disable the Sessions End All API endpoint. |
sessions_end_single | Enable/disable the Sessions End Single API endpoint. |
sessions_get | Enable/disable the Sessions Get API endpoint. |
session_count_active | Enable/disable the Session Count Active API endpoint. |
session_kill_ip | Enable/disable the Session Kill IP API endpoint. |
session_kill_user | Enable/disable the Session Kill User API endpoint. |
8. Logs & Webhooks#
| API Action | Description |
|---|
logs_delete_all | Enable/disable the Logs Delete All API endpoint. |
logs_delete_ip | Enable/disable the Logs Delete IP API endpoint. |
logs_get | Enable/disable the Logs Get API endpoint. |
webhook_create | Enable/disable the Webhook Create API endpoint. |
webhook_delete_all | Enable/disable the Webhook Delete All API endpoint. |
9. Other / Utilities#
| API Action | Description |
|---|
get_application_from_seller_key | Enable/disable the Get Application From Seller Key API endpoint. |
Custom Alert Messages#
You can customize the error and success messages returned by the API in the Alerts Tab to match your brand. All 15 alert messages are divided into 4 categories:1. Authentication Responses#
| Parameter Field | Display Title | Default Message / Description |
|---|
invalid_username | Invalid Username | Displayed when the username is not found (Username not found. Check and try again.). |
invalid_password | Invalid Password | Displayed when the wrong password is entered (Invalid password. Please try again.). |
success | Login Success | Successful authentication response (Logged in successfully). |
username_exists | Username Exists | Displayed when attempting to register an existing username (Username already taken, choose a different one). |
register_success | Registration Success | Successful user account creation response (Registered successfully!). |
2. License Responses#
| Parameter Field | Display Title | Default Message / Description |
|---|
invalid_license | Invalid License | Displayed when a non-existent or invalid license key is used (Invalid license key use a new one). |
used_license | Used License | Displayed when the key has already been redeemed (License key has already been used). |
3. Account Status Responses#
| Parameter Field | Display Title | Default Message / Description |
|---|
banned | Banned User | Displayed on a login attempt from a banned account (You are banned from using this application.). |
paused | Paused User | Displayed when an account is temporarily paused (Your account is temporarily paused. Contact support if needed.). |
expired | Expired Subscription | Displayed when the license subscription has expired (Your subscription has expired. Please renew to continue!). |
4. Hardware & Security Responses#
| Parameter Field | Display Title | Default Message / Description |
|---|
hwid_mismatch | HWID Mismatch | Displayed when logging in from an unauthorized machine (Device verification failed. SID mismatch.). |
hwid_updated | HWID Updated | Displayed when the hardware SID is successfully re-bound (SID updated successfully!). |
hwid_valid | HWID Valid | Device hardware SID valid verification response (Device SID is valid.). |
blacklist | Blacklisted | Displayed when the user/IP is blacklisted (Access Denied! Reason: Blacklisted). |
whitelist | Whitelist Block | Displayed when the IP is not on the allowed list (Your IP is not allowed (Whitelist active)). |
Customer Panel Configuration#
AuthVaultix keeps each application's data logically isolated and securely manages user accounts, license keys, remote variables, security policies, custom domains, and audit logs.1. Customer Panel Link#
Customer Panel Link: Dedicated public URL (https://authvaultix.com/panel/{ownerid}/{app_name}). The dashboard includes a one-click copy button to copy the direct link.
2. Panel Configuration Options#
Enable Customer Panel (Toggle): Master switch to enable or disable customer web portal access for end users. Allows users to access a dedicated page to manage their account and download updates.
Panel Icon URL: Custom icon image link displayed in browser tabs and SEO metadata previews (e.g. https://example.com/icon.png).
3. Custom Domain for Customer Panel#
Add Custom Domain: Use the domain input field and Add Domain button to host the customer web portal on your own custom domain or subdomain (e.g. panel.yourdomain.com) instead of the default authvaultix.com subpath.
Custom Domain Integration (Cloudflare API)#
You can connect a custom domain to AuthVaultix (for example auth.yourdomain.com):1.
Enter Custom Domain: Fill in your domain in Application Settings > Custom Domain.
2.
Cloudflare Verification Token: The system generates a verification TXT token (custom_domain_txt).
3.
DNS Configuration: Add a TXT record with your DNS provider pointing _cf-custom-hostname.yourdomain.com to the verification token.
4.
Verify Domain: Click Verify Domain. After Cloudflare propagation completes, the status changes from pending to verified, and Cloudflare will automatically provision the SSL certificate.
Modified at 2026-07-26 04:47:08
