Device-key proof
Enrolled device keys participate in session security so possession of a copied session value is insufficient by itself.
Platform capabilities
Security controls designed around the full authentication lifecycle.
LoaderAuth combines Windows licensing with developer identity, tenant isolation, management automation, private delivery and server-side enforcement.
Client security
Protect more than the licence key.
Client authentication is treated as an ongoing session and device-verification problem rather than a single local check.
Rotating sessions
Short-lived sessions rotate and remain subject to backend validation instead of becoming permanent bearer credentials.
Signed responses
Windows clients can verify signed server responses before accepting authentication state or protected metadata.
Replay resistance
Request identifiers, signed operations and server-side checks reduce the usefulness of replaying previously valid traffic.
Private release delivery
Tenant-scoped releases support signed manifests, one-time grants, revocation and SDK-side SHA-256 verification.
Secret separation
Management credentials and database secrets stay server-side rather than being embedded inside customer software.
Developer platform
Operate applications, organisations and teams with clear boundaries.
Organisation isolation
Applications, licences, releases, audit data and management credentials remain scoped to the active organisation.
Role-based access
Owner, administrator, developer, support, billing and read-only roles are enforced on the backend.
Mandatory MFA
TOTP, replay blocking and single-use recovery codes protect developer and operator access.
Management API
Organisation-scoped credentials support exact permissions, IP restrictions, signing and replay protection.
Signed webhooks
Webhook signing secrets are protected, delivery is HTTPS-only and retry events use stable identifiers.
Tamper-evident audit
Per-tenant keyed audit chains can be checked independently using the supplied verification tooling.
Windows integration
Integrate with public configuration only.
The current SDK targets Visual Studio 2022 and C++20 with static library, DLL and stable C ABI options.
A
Create an App ID
Your application carries public application configuration while privileged organisation credentials remain server-side.
B
Activate and resume
Licence activation and subsequent session resume flow through the LoaderAuth client API.
C
Verify protected releases
Signed manifests and expected hashes let your application verify private release payloads before trusting them.
Build the integration in staging first.
Create a developer organisation, configure an application and validate the SDK before a commercial launch.