# NineAuth Documentation

> NineAuth is a developer infrastructure platform for Identity, Access & Licensing in desktop software and native applications. It provides Argon2id authentication, hardware-bound license keys (HWID locking), runtime license validation, role-based access control (RBAC), HMAC-SHA256 signed webhooks, and sub-50ms cascade session revocation. Native SDKs are available for C#, C++, and Node.js.

Key implementation notes for coding agents:

- License validation is performed at the **Runtime API** (`api.nineauth.xyz/v1`), not the Management API
- Hardware ID (HWID) fingerprints are generated client-side and sent during license activation; the server stores and enforces the binding
- Sessions are short-lived opaque tokens tied to a license seat; revocation propagates in under 50ms
- RBAC entitlements are attached to license tiers, not users directly
- Webhook payloads are signed with `X-NineAuth-Signature` (HMAC-SHA256); always verify before processing
- Anti-replay protection uses single-use nonces with a 5-minute expiry window
- Billing integrates with CashinPay (PIX for Brazil) and Stripe for international payments

## Quickstart

- [5-Minute Quickstart](https://docs.nineauth.xyz/quickstart): Activate a license key, bind HWID, validate a session — end-to-end in 5 minutes

## Core Concepts

- [Applications](https://docs.nineauth.xyz/concepts/applications): How NineAuth organizes software products, environments, and API credentials
- [Licenses](https://docs.nineauth.xyz/concepts/licenses): License key structure, seat quotas, expiry, and tier-based entitlements
- [Sessions](https://docs.nineauth.xyz/concepts/sessions): Short-lived opaque tokens, how they are issued, validated, and revoked
- [RBAC — Role-Based Access Control](https://docs.nineauth.xyz/concepts/rbac): Dynamic feature entitlements and permission scopes per license tier
- [Webhooks](https://docs.nineauth.xyz/concepts/webhooks): Real-time lifecycle events (activation, revocation, expiry) with HMAC-SHA256 signatures
- [Anti-Replay Protection](https://docs.nineauth.xyz/concepts/anti-replay): Single-use nonce system that prevents replay attacks on the Runtime API

## Integration Guides

- [License Activation Guide](https://docs.nineauth.xyz/guides/license-activation): Step-by-step activation flow including HWID binding and error handling
- [Session Validation Guide](https://docs.nineauth.xyz/guides/session-validation): How to validate sessions on every authenticated request without latency overhead
- [Webhook Delivery Guide](https://docs.nineauth.xyz/guides/webhook-delivery): Receiving, verifying, and processing webhook events with exponential backoff retry
- [Billing with CashinPay (PIX)](https://docs.nineauth.xyz/guides/billing-cashinpay): Integrate PIX payments for Brazilian customers using the CashinPay flow
- [Permissions & Roles Guide](https://docs.nineauth.xyz/guides/permissions-and-roles): Implementing feature flags and role-gating inside your application
- [Hard-Delete an Application](https://docs.nineauth.xyz/guides/hard-delete-application): Permanently removing an application and all associated data

## API Reference

- [API Reference Overview](https://docs.nineauth.xyz/api-reference): Authentication, base URLs, error codes, and rate limits
- [Runtime API](https://docs.nineauth.xyz/api-reference/runtime): Endpoints used at runtime inside customer software (license activate, session validate, nonce issue)
- [Management API](https://docs.nineauth.xyz/api-reference/management): Dashboard-side endpoints for creating licenses, resetting HWIDs, and managing applications

## SDKs

- [Node.js SDK](https://docs.nineauth.xyz/sdks/nodejs): Official server-side SDK for Node.js / TypeScript — license management and webhook verification
- [C# SDK](https://docs.nineauth.xyz/sdks/csharp): Official client SDK for .NET / C# desktop applications — activation, session, HWID fingerprinting
- [C++ SDK](https://docs.nineauth.xyz/sdks/cpp): Official client SDK for native C++ applications — static lib, CMake integration, activation flow

## Optional

- [Changelog](https://docs.nineauth.xyz/changelog): API and SDK version history with breaking change notices
- [Main Website](https://nineauth.xyz): Marketing site with pricing, feature comparisons, and security architecture overview
- [NineAuth llms.txt](https://nineauth.xyz/llms.txt): llms.txt for the main marketing site (pricing, features, company)