NineAuthDocs
Core ConceptArchitecture

Applications

Applications are isolated cryptographic security tenants in NineAuth. Each application maintains its own API keys, end-users, license policies, audit records, and webhook endpoints.

Isolation Boundaries

In NineAuth, applications provide strict multi-tenant partition boundaries:

  • User Database: End-users registered in App A cannot authenticate against App B.
  • Hardware Fingerprints: HWID bindings are scoped strictly per application.
  • Opaque Sessions: Session tokens issued by one application cannot access resources in another.
  • Secrets & Master Keys: Each application possesses independent signing keys for webhook HMAC verification.

API Key Types

Every application provides two key tiers:

Key PrefixScopeUsage
app_pub_live_*Client RuntimeShipped inside native desktop binaries for runtime authentication.
app_sec_live_*Management AdminBackend servers only. Full CRUD control over licenses and users.
Never Ship Secret Keys
Never embed app_sec_live_* keys inside native desktop executables (C#, C++, or Electron). Reverse engineers can extract them with strings or memory inspection. Use app_pub_live_* for client binaries.
Management: Applications API →
List, create, update, and manage application configurations programmatically.
Hard-Delete & Snapshots Guide →
Understand data retention and audit snapshots in application_snapshots.