got questions?
WE HAVE ANSWERS.

BetterAuth is a self-hosted software licensing and authentication platform designed for developers who ship desktop applications, tools, or any software that needs license key validation and user management. It provides HWID-locked licensing, encrypted file delivery, real-time analytics, webhook integrations, and a full REST API. Whether you're an indie developer with one product or a studio shipping dozens, BetterAuth scales with you.

Getting started takes under five minutes. Create a free account, set up your first application, generate license keys, and integrate our API into your software using one of our SDKs (C++, C#, Python, Node.js). The Basic tier is completely free — no credit card required — and includes 3 application slots with 100 keys and 100 users each. Check our documentation for step-by-step guides.

BetterAuth is language-agnostic because it's built on standard REST APIs. We provide official SDKs and example implementations for C++, C#, Python, Node.js, and Rust. Since the API uses standard HTTP with JSON responses, you can integrate it with virtually any language that supports HTTP requests. Community-maintained wrappers exist for Go, Java, and Ruby as well.

Yes. BetterAuth is designed to be self-hosted on any PHP-capable web server. You need PHP 8.x with the cURL extension, a Supabase project for the database layer, and a writable cache/ directory. There are no Composer dependencies, no npm build steps, and no frameworks — just copy the files to your server, configure your .env file, and you're running. XAMPP, nginx, Apache — it works on all of them.

You need: (1) A web server with PHP 8.x and the cURL extension enabled. (2) A Supabase account with a project set up (free tier works). (3) A writable cache/ directory on your server for rate limiting and temporary data. That's it. No Composer, no Node.js, no database server to manage — Supabase handles PostgreSQL for you. Configure your .env with your Supabase credentials and you're ready.

HWID (Hardware ID) locking binds a license key to a specific machine. When a user first authenticates, BetterAuth captures a unique hardware fingerprint — derived from CPU, motherboard, disk, and MAC address identifiers. Subsequent authentication attempts from different hardware are rejected. The system is spoof-resistant and supports configurable reset limits so users can migrate to new hardware without opening a support ticket.

Yes. BetterAuth supports custom key masks that let you define the exact format of your license keys. You can specify prefixes (e.g., MYAPP-XXXX-XXXX-XXXX), character sets (alphanumeric, hex, numeric-only), segment lengths, and separators. The Premium tier offers partial customization, while the Ultra tier provides full control over every aspect of the key format. Bulk generation supports thousands of keys per second.

BetterAuth supports multiple license types: (1) Time-limited — keys that expire after a set duration (1 day to lifetime). (2) Subscription — recurring licenses with automatic expiry and renewal. (3) Tiered — multi-level licenses (Basic, Premium, etc.) with different feature sets. (4) Trial — time-limited keys with restricted functionality. All types support HWID binding, variable injection, and webhook triggers on state changes.

You can revoke, ban, or delete any license key from the dashboard or via the API. When a banned key attempts to authenticate, the API returns an appropriate error code. Bans can be temporary (with an auto-unban date) or permanent. You can also ban individual users, which revokes all associated keys. All actions are logged and can trigger webhooks to notify your Discord or Telegram channels.

Yes. The Bulk Generation feature lets you create hundreds or thousands of keys in a single API call or dashboard action. You can specify the key format, tier/level, duration, and any custom metadata. Generated keys are returned instantly and can be exported as a CSV or JSON file. The Ultra tier supports generating up to 10,000 keys in a single operation.

The BetterAuth API consistently responds in under 50ms for authentication endpoints. We achieve this through persistent cURL handles (no connection overhead), optimized Supabase queries, and a lightweight PHP codebase with zero framework bloat. Our median response time over the last 30 days is 42ms. You can monitor real-time performance on our status page.

BetterAuth offers multiple API versions: v1 (stable RESTful JSON API), v2 (latest with custom path-based routing and stricter validation), and legacy 1.0/1.1 endpoints for backward compatibility. We recommend using v2 for new integrations. All versions return JSON, use standard HTTP status codes, and support the same core operations. Check the documentation for the full endpoint reference.

Webhooks let you receive real-time HTTP POST notifications when events occur in your application. Supported events include: license creation, activation, expiration, ban/unban, user registration, login, and HWID changes. You can configure webhooks for Discord (formatted embeds), Telegram (formatted messages), or any custom endpoint. Webhooks are configured per-application in the dashboard and can be tested with a single click.

Yes, to protect the platform from abuse. Rate limits are file-based and vary by tier: Basic accounts get 60 requests per minute, Premium gets 120, and Ultra gets 300. Rate limit headers are included in every API response so your client can adapt dynamically. If you need higher limits for a specific use case, contact us and we'll work with you.

Absolutely. BetterAuth is designed as a standalone service that integrates with any backend architecture. Your software client communicates with BetterAuth for authentication, while your own backend handles business logic. You can use webhooks to sync data, or query the BetterAuth API from your server-side code. The API is stateless and uses standard REST conventions, so it fits naturally into microservices, monoliths, or serverless architectures.

Yes. The Basic plan is completely free and includes 3 application slots, 100 license keys per app, 100 users per app, and full API access. It's perfect for prototyping, small projects, or evaluating the platform. No credit card is required to sign up, and there's no time limit on the free tier. Upgrade whenever you're ready.

Premium ($20/mo) includes 20 app slots, 5,000 keys/users, 5 sub-accounts, partial key customization, priority API limits, and priority support. Ultra ($30/mo) includes unlimited apps, 50,000 keys/users, 25 sub-accounts, full key customization, HWID device binding, bulk license operations, and dedicated support. Both paid plans include a 14-day money-back guarantee.

Yes. You can upgrade or downgrade your plan at any time from the dashboard. When upgrading, the price difference is prorated for the remainder of your billing cycle. When downgrading, your current plan benefits remain active until the end of the billing period. If you exceed the limits of a lower tier, you'll be prompted to reduce usage before the downgrade takes effect.

We accept all major credit and debit cards (Visa, Mastercard, American Express), PayPal, and cryptocurrency (Bitcoin, Ethereum, USDT). All payments are processed securely through encrypted payment processors. We never store your full card details on our servers. Annual billing is available with a discount — contact sales for details.

We offer a 14-day money-back guarantee on all paid plans. If BetterAuth doesn't meet your needs within the first 14 days, request a full refund via the dashboard or by emailing [email protected]. After 14 days, refunds are handled on a case-by-case basis. See our full refund policy for details.

All data is encrypted in transit (TLS 1.3) and at rest using AES-256 encryption. Sensitive values like license keys and API secrets are hashed before storage. The platform uses Supabase (PostgreSQL) which provides automatic encryption, row-level security, and daily backups. File delivery uses encrypted payloads that can only be decrypted by authenticated clients. We never log plaintext passwords or API keys.

Yes. BetterAuth supports TOTP-based two-factor authentication (compatible with Google Authenticator, Authy, and other authenticator apps). 2FA is required for admin panel access and recommended for all accounts. The platform generates secure QR codes for easy setup. Recovery codes are provided during enrollment for emergency access.

We take security seriously. Reports to [email protected] are acknowledged within 4 hours. Critical vulnerabilities are patched within 48 hours. We conduct regular security audits, automated vulnerability scanning, and code reviews. All security patches are documented in our changelog. We also run a responsible disclosure program with bounties for significant findings.

Application secrets are stored hashed in the database and are never logged or exposed in API responses. The secret is only shown once during creation — after that, you need to regenerate it if lost. All API calls requiring the secret use server-side validation. We recommend storing your secret in environment variables, never hardcoding it in client-side code or public repositories.

BetterAuth provides multiple layers of protection: (1) HWID binding prevents key sharing. (2) Concurrent session limits control simultaneous usage. (3) IP-based anomaly detection flags suspicious patterns. (4) Encrypted variable delivery prevents static analysis. (5) VPN/proxy heuristics add an extra verification layer. No system is unbreakable, but BetterAuth makes piracy significantly harder and more time-consuming than simply buying a license.