A production-ready Python SDK and example application for AuthLX — the authentication and license management platform for desktop software.
This repository shows how to securely integrate AuthLX into any Python application, with a full suite of runtime security features built in.
| Feature | Description |
|---|---|
register() |
Register a new user by activating a license key |
login() |
Authenticate with username, password, and HWID |
web_login() |
Authenticate without HWID (web/admin panels) |
logout() |
Invalidate the session on the backend |
check() |
Verify whether the current session is still active |
verify_token() |
Validate a standalone API token |
| Feature | Description |
|---|---|
changeUsername() |
Rename the currently logged-in user |
forgot() |
HWID-verified password reset |
upgrade() |
Apply a second license key to extend a subscription |
| Feature | Description |
|---|---|
has_active_subscription() |
Returns True if the subscription has not expired |
expiry_remaining() |
Seconds remaining until the subscription expires |
mark_authenticated() |
Flags the user as authenticated and records runtime start |
refresh_auth_runtime() |
Resets the authentication runtime timestamp |
| Feature | Description |
|---|---|
| HWID Locking | Binds accounts to a physical hardware ID (Windows, macOS, Linux) |
| Anti-Tamper | SHA-256 checksum of the running script sent to the backend on login |
| Anti-Debug | Kills the process if a Python debugger (sys.gettrace()) is detected |
| Anti-MITM | session.trust_env = False disables proxy auto-configuration |
| Host Locking | Blocks all HTTP requests to non-whitelisted domains |
| Public-Key Pinning | Hook point for TLS certificate pin verification |
| Payload Cryptography | HMAC-SHA256 seal + XOR field encryption helpers |
Hardened req() |
Custom HTTP wrapper that enforces host-locking and key-pinning |
| Feature | Description |
|---|---|
record_login_fail() |
Increments the failure counter |
lockout_active() |
Returns True when a 5-minute lockout is in effect |
lockout_remaining_ms() |
Milliseconds left in the current lockout |
reset_lockout() |
Clears the failure counter and lockout |
bad_input_delay() |
2-second delay injected after each failed login attempt |
| Feature | Description |
|---|---|
start_ban_monitor() |
Starts a background thread that polls session validity |
stop_ban_monitor() |
Stops the ban monitor thread |
ban_monitor_running() |
Returns True if the monitor thread is alive |
pip install -r requirements.txtWindows users also need
pywin32for advanced HWID generation.
Open main.py and set your application details:
APP_NAME = "MyApp"
APP_ID = "YOUR-APP-UUID-HERE" # from your AuthLX Dashboard
APP_VERSION = "1.0"
APP_HASH = others.get_checksum() # auto-computed SHA-256python main.pyYou will see an interactive console where you can test every SDK feature.
AuthLX-Python-Example/
├── authlx.py ← The SDK (import this in your own projects)
├── main.py ← Interactive example demonstrating all features
├── requirements.txt ← Python dependencies
└── other-examples/
├── merged_example.py ← SDK + example in one standalone file
├── method1.py ← Recommended: your code below the login gate
├── method2.py ← Alternative: functions defined above main()
└── README.md ← Explanation of each integration pattern
-
Anti-Debug (
others.anti_debug()) — called automatically duringapi.__init__(). Exits immediately if a debugger is attached. -
Anti-MITM (
session.trust_env = False) — forces therequestslibrary to ignore local proxy environments (Fiddler, Charles, Burp Suite, etc.). -
Anti-Tamper (
others.get_checksum()) — computes a real-time SHA-256 ofsys.argv[0]and sends it to the backend on everylogin()call. Enable Hash Check in your AuthLX Dashboard to reject modified executables automatically. -
HWID Locking — each
login()call sends the machine's Hardware ID. If it doesn't match the one on file, the backend rejects the request with a clear error message directing the user to request an HWID reset. -
Ban Monitor — call
start_ban_monitor()after login to run a background daemon that periodically callscheck(). If the session is revoked (e.g. by an admin ban), the process exits immediately viaos._exit(1). -
Host Locking — call
set_allowed_hosts(["authlx.com"])to restrict all HTTP requests made through the SDK to approved domains only.
This SDK is provided open-source under the MIT License. Feel free to modify and adapt it for your own Python projects.