Getting Started

How It Works

From your user clicking 'get key' to your code letting them in, here's the full flow.

The big picture

Your software asks Panda Auth one question: "is this key allowed to run here, right now?" Everything else (handing out the key, making users pass ad checkpoints, locking the key to a device) happens around that one check.

The GetKey flow

Your app sends the user to the GetKey page

The user opens your GetKey link, which carries their device id:/getkey/{identifier}?hwid={user-hwid}. Your client library detects the HWID automatically.

The user clears the checkpoints

If you've enabled monetization, the user passes your configured checkpoints (1 to 10), one ad provider at a time.

A key is generated

After the last checkpoint, Panda Auth issues a key (for examplePANDA-A8F3-K9X2-M7B4) bound to that HWID, with whatever expiry you set (e.g. 24 hours).

The user pastes the key into your software

Your script or app takes the key from the user.

Your code validates the key

Your client library sends the key + HWID to Panda Auth. The result is one of: Valid, Expired, Invalid, or Blacklisted. You let the user in only on Valid.

Why HWID matters

A key is tied to the device that requested it. If someone copies the key to another machine, the HWID won't match and validation fails. This is what stops one paid (or ad-earned) key from being shared with a whole server.

Instant Access skips the page

You don't have to use a GetKey page at all. With Instant Access mode you grant access by HWID directly, with no checkpoints and no key to paste. See Instant Access Mode under For Developers for setup.

What you configure

The flow above is the default. From the dashboard you decide how many checkpoints, which ad providers, how long keys last, what the GetKey page looks like, and which security checks run. The next page walks you through your first run end to end.