Verified v1.0Estimated time: 4 mins
5-Minute Quickstart
Make your first verified NineAuth API calls in under 5 minutes. This guide walks you through registering an end-user, activating a license key with hardware fingerprint locking (HWID), and validating the resulting opaque session token.
1. Create Account & Get API Key
Before calling the Runtime API, you need an active Application and its client API Key.
- Log in to the NineAuth Console.
- Navigate to Applications → Create Application.
- Under API Keys, copy your
Client API Key.
API Key Security
The Client API Key identifies your application in desktop clients. Keep your Management Master Secrets safe on your backend servers.
2. Register an End-User
Desktop users authenticate against your application. NineAuth secures all credentials with memory-hard Argon2id hashing.
import { NineAuthClient } from "@nineauth/sdk";
const client = new NineAuthClient({
apiKey: "app_pub_live_9f83a2...",
baseUrl: "https://api.nineauth.xyz",
});
const user = await client.auth.register({
email: "dev@example.com",
password: "SuperSecretPassword123!",
});
console.log("Registered user ID:", user.user_id);3. Activate License with HWID
Bind the user and machine fingerprint (HWID) to an issued license key.
const activation = await client.licenses.activate({
licenseKey: "NINE-PRO-8891-2294-XXXX",
email: "dev@example.com",
password: "SuperSecretPassword123!",
hwid: "hwid_sha256_e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
});
console.log("Session token:", activation.token);
console.log("License plan:", activation.license.plan);4. Validate Session Token
On subsequent requests or native loop checks, validate the opaque 256-bit session token.
const session = await client.sessions.validate({
token: activation.token,
hwid: "hwid_sha256_e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
});
if (session.valid) {
console.log("User authorized. Roles:", session.roles);
}