Client security
Licence checks are treated as live security state.
A copied key or stale session should not become permanent access. LoaderAuth keeps authentication tied to backend policy and enrolled device proof.
◇
Device-key proof
Enrolled asymmetric device credentials participate in protected requests and session establishment.
↻
Rotating sessions
Short-lived sessions rotate and remain revocable instead of becoming permanent bearer credentials.
⟲
Replay resistance
Request identifiers, proofs and backend checks reduce the usefulness of replaying previously valid traffic.
Application users
Give protected applications their own account layer.
Application-scoped users remain separate from LoaderAuth developer accounts. Registration, login, licence upgrades, suspension and recovery are controlled by the application tenant.
1
Register with entitlement
Create an end-user account against an eligible licence without exposing developer credentials.
2
Require MFA where needed
TOTP challenges, recovery codes and replay protection add a second factor to protected sign-in.
3
Revoke immediately
Suspension, bans and password recovery invalidate old authenticated state rather than waiting for expiry.
Protected files
Deliver private payloads without turning storage into a public download folder.
Protected files stay outside the public web root. LoaderAuth issues short-lived one-time grants only after the authenticated client session and entitlement are checked.
⌁
Private storage
Arbitrary protected files remain outside public web paths and can be replaced or revoked by the developer.
✓
Exact manifest
File ID, byte size and SHA-256 are signed into the delivery metadata used by the client.
→
Atomic replacement
The SDK verifies the completed download before replacing the destination file.
Developer operations
Security-sensitive management stays tenant scoped and auditable.
Applications, licences, users, variables, releases and management actions stay inside the active organisation boundary.
▦
Organisation isolation
Cross-tenant access is blocked at the backend rather than relying on hidden UI controls.
◎
Audit trail
Security-sensitive actions are recorded with tamper-evident audit support.
↗
Signed webhooks
Server-to-server integrations use signed delivery and stable event identifiers.
Windows SDK
Integrate the client without shipping your management secrets.
LoaderAuth targets Visual Studio, C++ and a stable C ABI for DLL consumers. Customer software carries public application configuration while privileged organisation credentials stay on the server.
loaderauth::AuthClient auth(config);
auto result = auth.login(username, password);
if (result.mfa_required) {
result = auth.complete_mfa(code);
}
if (!result.ok) {
// deny protected application access
}