Secure vault
The source stays on our side
Upload once. ArcticAuth obfuscates and encrypts it, then streams a single session copy over a websocket that is decrypted in memory. Nothing readable is written to disk on the client.
Hardware binding
Every key carries its own hardware and place bindings. A key that has been passed around stops at the gate instead of after the damage.
Per-session
Encrypted delivery
Hardware-bound
Key validation
Lua + C#
Client libraries
Live
Revocation control
One request, inspected
Every run passes six gates before a single byte is sent.
Delivery chain
- 01Loader runsGET /secure_vault/9f2c41/run_scriptallow
- 02Identity readplayer 271635429 · hwid 4f9c8e21…d21aallow
- 03Environment readplace 1153095018 · executor Deltaallow
- 04Key checkedbound to this hwid · 3 days remainingallow
- 05Session signedplace_authorized · 60 second envelopeallow
- 06Script streamedencrypted over websocket · decrypted in memoryallow
Six gates, one request. The script only exists on the client after the last one clears.
Capabilities
Everything needed to control access.
Keys and hardware
Bind a key to a machine, a game, or both
Issue keys through an ad checkpoint, a whitelist, or a direct grant. Set hardware binding and expiry per key, apply place policies during validation, and stop a shared key at the gate rather than after the fact.
Checkpoints
Change ad provider without reissuing keys
Route users through Linkvertise or your own provider, set the number of checkpoints, and switch between them from the dashboard. Keys already in the wild keep working.
Validation
Drop-in clients for Lua and C#
Both talk to /api/validation/v1 over an encrypted envelope with a signed handshake, so a proxy in the middle sees a session token and nothing else.
Start protecting your delivery
Give users access without giving away the file.
Create a service, upload your script, and issue your first hardware-bound key from one dashboard.