C# / .NET client

Getting the library

One assembly, no native dependencies. It multi-targets netstandard2.0 - which covers .NET Framework 4.6.1 and up, Unity and Mono - and net8.0 for modern hosts, so a reference resolves to the right one on its own.

dotnet build src/ArcticAuth.Client/ArcticAuth.Client.csproj -c Release

# src/ArcticAuth.Client/bin/Release/netstandard2.0/ArcticAuth.Client.dll
# src/ArcticAuth.Client/bin/Release/net8.0/ArcticAuth.Client.dll

Builds are deterministic: the same source produces the same bytes. That is what makes the download above checkable - build the project yourself and compare the SHA-256 against the file you got. If they match, the assembly you are about to ship is the one we published, and you did not have to trust the link to find that out.

Quick start

Three lines to a verdict. The service id is not a secret - it is already in the key page URL your users visit - so shipping it inside your binary is not a leak.

using ArcticAuth.Client;

using var client = new ArcticAuthClient("your-service-id");

var result = await client.ValidateAsync(userEnteredKey);

if (!result.IsValid)
{
    Console.WriteLine(result.Message ?? result.Reason.ToString());
    Console.WriteLine($"Get a key: {client.GetKeyUrl()}");
    return;
}

// Valid. Now go and fetch something only a valid session can get.

ArcticAuthClient

new ArcticAuthClient(serviceId, apiBaseUrl?, httpClient?)

Binds a client to one service. Pass your own HttpClient to share a connection pool or install a handler - when you do, its lifetime stays yours and this will not dispose it. apiBaseUrl is for a self-hosted deployment.

ValidateAsync(key, ct) -> Task<ValidationResult>

Checks a key against this service and this machine. Never throws for an expected condition: no network, a timeout, a malformed reply and a refused key all come back as a result, because the caller has to handle "could not check" either way.

PingAsync(ct) -> Task<bool>

Whether the API is answering. Lets you tell "the service is down" apart from "my key is bad" without spending a validation.

GetKeyUrl(keyPageBaseUrl?) -> string

The key page for this service with the hardware id already attached, so the page can bind a key to this machine without the user typing anything.

HardwareIdentifier -> string

The machine id this client reports. Show it on a support screen: a wrong-machine refusal is about this exact string, and having the user read it out beats guessing.

The default endpoint is https://api.arcticauth.com/api/validation/v1.IDisposable, so using it is the normal shape.

Reading the result

IsValid -> bool

Whether the server accepted the key. Read the warning below before building anything important on it.

Reason -> ValidationReason

Why it was refused. None when it was not.

Message -> string?

The server's own wording, when it sent any. Safe to show a user.

ExpiresAt -> DateTimeOffset?

When the key stops working, if the server said.

IsTransient -> bool

Whether retrying later might succeed. True for Unreachable, RateLimited and BadResponse; false for a key that is simply bad. This is the flag to branch on for a retry, not the reason.

Refusal reasons

A closed enum, so you can switch on it. An unrecognised string from the server maps to Unknown rather than throwing: a server that adds a reason must not break clients built before it existed.

MissingKey

No key was supplied.

InvalidKey

No such key, or it does not belong to this service.

Expired

The key exists and its window has passed.

Revoked

Pulled by the service owner.

HardwareMismatch

Valid key, different machine. It belongs to the one that redeemed it first.

MissingHardwareId

The server needed a machine to bind to, or to rule on against the trust list, and the request named none.

Blocked

The owner put this machine on the trust list as blocked.

NotTrusted

The service runs an allow-only trust list and this machine is not on it. Nobody banned them; they were never invited.

ServicePaused

The service exists and its owner has taken it offline.

NoService

No such service. Check the id you compiled in.

RateLimited

Too many attempts from here. Back off and retry.

Unreachable

The request never completed: no network, DNS, TLS, timeout.

BadResponse

A reply arrived and could not be understood.

Unknown

The server said something this client has no name for.

switch (result.Reason)
{
    case ValidationReason.HardwareMismatch:
        Show($"That key belongs to another machine. This one is {client.HardwareIdentifier}.");
        break;

    case ValidationReason.Expired:
    case ValidationReason.Revoked:
    case ValidationReason.InvalidKey:
        Show($"Get a key: {client.GetKeyUrl()}");
        break;

    default:
        // Transient: the wifi dropped or we are being rate limited. Not their fault,
        // and not a reason to wipe a stored key.
        if (result.IsTransient) ScheduleRetry();
        break;
}

Hardware ID

A SHA-256 over the machine name, user name, OS platform and processor count, hashed before it leaves. The raw inputs are personal data the server does not need - it only needs to know whether two runs came from the same place.

Protecting a desktop client

Worth being blunt, because this is the part that differs most from the Roblox vault. There, a failed check returns no script bytes, so there is nothing on the machine to patch. Here your whole program is already on the attacker's disk before the first check runs.

What actually works is moving the value to where the patch cannot reach:

• Ship the feature, not the flag. Have the server return the thing a paid user came for - the model, the data, the licence file, the computed answer - on a validated session. Patching the check then yields a program with nothing to show.
• Validate on use, not only on start. A check at launch is one branch to find. A check bound to each server round trip is not a branch at all.
• Treat transient failures as transient. Wiping a stored key because the wifi dropped is the single most common way a licence system loses a paying customer. Branch on IsTransient.

The repository's PROTECTION.md goes through this at length, with the threat model spelled out.