C# · API 1.1 · AES-256-CBC

VelvetAuth C# Client

These docs cover the official vauth class in documentation/client/vauth.cs. Add that file to your WinForms or .NET app and talk to API 1.1 — you do not call the HTTP API by hand.

The class posts JSON to /api/1.1/index.php. Sensitive fields are encrypted with your app secret before they leave the client. Hardware ID is taken automatically from the current Windows user SID.

Download vauth.cs · Raw API 1.1 reference

Add the class

Create an application in the dashboard and copy your App ID and Secret.
Add vauth.cs to your C# project.
Install Newtonsoft.Json from NuGet.
Set _apiBaseUrl in the class to your VelvetAuth host (it currently defaults to localhost).

Install-Package Newtonsoft.Json

private string _apiBaseUrl = "https://your-domain.com/api/1.1/";

The client is a WinForms-friendly class. It uses HttpClient, AES encryption, and the Windows identity for HWID.

Create a client

public vauth(string appId, string secret, string version)

Pass the values from your dashboard. The constructor encrypts appId and version with the secret and keeps the secret for later requests. The class implements IDisposable — wrap it in using.

using (var auth = new vauth("YOUR_APP_ID", "YOUR_SECRET", "1.0"))
{
    if (!auth.Initialize())
        return;

    // register, login, etc.
}

Parameter	Description
`appId`	Application ID from dashboard Settings
`secret`	Hex secret used as the AES-256 key
`version`	Client version string your app expects (e.g. `1.0`)

Properties

After a successful RegisterLicense or LoginUser, user details are stored on the instance.

Property	Type	Description
`Username`	string	Logged-in username
`Email`	string	Email returned by the API
`user_level`	int	License / user level
`ExpiryDate`	DateTime?	Subscription expiry, or null
`_sessionId`	string	Session from `Initialize()`
`_hwid`	string	Windows SID — set automatically

if (auth.LoginUser(username, password))
{
    string name = auth.Username;
    string email = auth.Email;
    int level = auth.user_level;
    DateTime? expiry = auth.ExpiryDate;
}

Initialize

public bool Initialize()

Call this first. Sends type: "init" and stores session_id on success. Register, login, logout, and password reset all need that session.

if (!auth.Initialize())
{
    MessageBox.Show("Could not initialize VelvetAuth.");
    return;
}

Returns true when the API responds with status: "true". Common failures: wrong secret, wrong app version, or the server is unreachable.

RegisterLicense

public bool RegisterLicense(string username, string password, string licenseKey, string email)

Creates a user with a license key. Requires a session from Initialize(). On success it fills Username, Email, ExpiryDate, and user_level.

bool ok = auth.RegisterLicense(
    "player1",
    "secure_password",
    "XXXX-XXXX-XXXX",
    "[email protected]"
);

API type: register. Username, password, license, email, HWID, and session ID are encrypted automatically.

keyless_register

public bool keyless_register(string username, string password, string email)

Registers without a license key. Keyless mode must be enabled for the app in the dashboard.

bool ok = auth.keyless_register("player1", "secure_password", "[email protected]");

API type: keyless. Typical errors: username already used, email already used, or keyless disabled.

LoginUser

public bool LoginUser(string username, string password)

Logs in with username and password. HWID and session ID are attached automatically. On success the same user properties as register are populated.

if (auth.LoginUser(txtUser.Text, txtPass.Text))
{
    // open your main form
}

API type: login. Failures include wrong credentials, HWID mismatch, paused/banned user, expired license, or a missing session.

Logout

public bool Logout()

Ends the current session for the logged-in username. Call this when the user signs out of your app.

auth.Logout();

API type: logout. Success message: Logout successful.

ForgotPassword

public bool ForgotPassword(string email)

Sends a reset code to the user's email. Initialize() must have already succeeded.

if (auth.ForgotPassword("[email protected]"))
{
    // ask the user for the email code, then call ResetPassword
}

API type: forgot_password. Success message: Password reset code sent.

ResetPassword

public bool ResetPassword(string email, string code, string newPassword)

Completes a password reset with the code from email. Also requires Initialize() first.

bool ok = auth.ResetPassword(
    "[email protected]",
    txtCode.Text,
    txtNewPassword.Text
);

API type: reset_password. Success message: Password reset successful.

ExtendLicenseExpiry

public bool ExtendLicenseExpiry(string username, string licenseKey)

Applies another license key to an existing user and updates ExpiryDate from data.new_expiry_date.

if (auth.ExtendLicenseExpiry(auth.Username, "NEW-XXXX-XXXX"))
{
    DateTime? newExpiry = auth.ExpiryDate;
}

API type: extend_expiry.

Log

public bool Log(string message)

Sends an encrypted message to the Discord webhook configured in your app settings. The server appends the client IP.

auth.Log(auth.Username + " opened the loader");

API type: log. Success message: Log sent to Discord. Set a webhook URL in Settings or this will fail.

Encryption

You normally do not encrypt anything yourself. The class encrypts fields before each request.

Setting	Value
Algorithm	AES-256-CBC
Key	App secret (hex → bytes)
IV	16 random bytes, prepended to ciphertext
Output	Base64(IV + encrypted bytes)

Helpers if you need them:

public static string EncryptString(string keyHex, string plainText)

public static string DecryptString(string keyHex, string cipherText)

secret and type are sent in plaintext. Everything else the methods send (username, password, email, license, HWID, session, message) is encrypted.

Example flows

New user with a license

using (var auth = new vauth(appId, secret, "1.0"))
{
    if (!auth.Initialize()) return;

    if (auth.RegisterLicense(user, pass, license, email))
    {
        // auth.Username, auth.ExpiryDate, auth.user_level
    }
}

Returning user

using (var auth = new vauth(appId, secret, "1.0"))
{
    if (!auth.Initialize()) return;

    if (auth.LoginUser(user, pass))
    {
        auth.Log(user + " logged in");
        // show main UI
        auth.Logout();
    }
}

Forgot password

using (var auth = new vauth(appId, secret, "1.0"))
{
    if (!auth.Initialize()) return;

    auth.ForgotPassword(email);
    // user enters the email code
    auth.ResetPassword(email, code, newPassword);
}

FAQ

Do I need to call the REST API myself?

No. Use the vauth methods. They POST to /api/1.1/index.php with the correct type and encryption.

Why does init fail with a version error?

The version you pass to the constructor must match the version set on the application in the dashboard.

Why does login fail after it worked on another PC?

HWID is bound to the Windows user SID. A different machine or Windows account will not match.

What NuGet packages are required?

Newtonsoft.Json. The rest is in the .NET Framework / Windows Forms references already used by vauth.cs.

Where is the low-level API documented?

See the API 1.1 reference if you are writing a client in another language. For C#, stay on this page and use vauth.cs.