key/activate

Activation endpoint called by the Vampauth launcher injected into SDK-mode scripts. It runs the same validation ladder as key/check — not found, banned, expired, project HWID ban, fingerprint mismatch — persists usage stats and lazy HWID binding, and returns a launcher-friendly body. You normally never call this yourself: scripts saved in Vampauth SDK mode ship it built in. Use key/check for your own clients or Custom SDK scripts.

Request

POST /api/v1/key/activate Content-Type: application/json. Only accepted from injected launcher builds. Headers

Header	Required	Notes
`X-Vampauth-Injected`	yes	Must be `1`. Requests without it get `403`.
`X-Vampauth-Nonce`	yes	Random value, at most 64 chars. Fresh per call.
`X-Vampauth-Signature`	yes	`HMAC_SHA1(auth_secret, nonce\|key\|hwid)`, lowercase hex.

Body

Field	Type	Required	Notes
`project_id`	string	yes	Your public project ID.
`auth`	string	yes	The project’s auth secret, echoed. Compared timing-safely.
`key`	string	yes	The license key to validate.
`hwid`	string	yes	Hardware ID from the client. Passthrough.
`executor`	string	no	Plain executor label. Max 64 chars.

{
  "project_id": "2Q9V222NTI2WJ45N",
  "auth": "c3499ac4ae2f5ca6715e9ee04cfe542aa5070593d6fa6341",
  "key": "A13A-6D58-A93C-6AC7",
  "hwid": "delta-live-test-hwid",
  "executor": "Delta"
}

Success response

HTTP 200:

{
  "status": "valid",
  "hwid_bound": true,
  "expires_at": "2026-12-31T23:59:59.000Z",
  "signature": "7138f26fdda7f37abf453c67fe5675daca003490",
  "project_id": "61b4a242-e6b3-4765-aefb-23904d92d984"
}

The launcher only runs your script when status is valid.

Errors

Every non-2xx returns { "status": "invalid", "reason": "..." }. The launcher maps reasons to its configured failure action (kick, console, or silent).

HTTP	`reason`	Meaning
400	`invalid_request`	Missing/malformed body field.
401	`bad_auth`	Body `auth` doesn’t match the project’s auth secret.
401	`bad_signature`	Header signature doesn’t match — tampered request.
401	`invalid`	Unknown `project_id`.
403	`forbidden`	Request didn’t come from an injected launcher build.
403	`key_banned`	Key is banned or revoked.
403	`fingerprint_mismatch`	Key is bound to different hardware and isn’t FFA.
403	`hwid_banned`	This device is banned from the project.
404	`key_not_found`	No such key on this project.
410	`key_expired`	Key has expired.
429	`rate_limited`	Over 120 req / 60s per IP.
500	`internal_error`	Unexpected server error.

Getting Started

Platform

REST API

Guides

key/activate

key/activate

Request

Success response

Errors

​key/activate

​Request

​Success response

​Errors

key/activate

Request

Success response

Errors