Authentication

How applications authenticate with Archangel, manage sessions, and handle hardware binding.

License Authentication

License authentication is the standard flow for most applications. The client submits a license key, Archangel validates it on the server, and returns a signed session containing user information and license details.

Authentication Flow

1. The application initializes with Archangel and confirms it is active and reachable.
2. The user enters a license key, which is sent to Archangel together with an optional hardware fingerprint.
3. Archangel validates the key, checks its status and expiry, binds hardware when enabled, and returns a signed session.
4. The application sends periodic heartbeats to keep the session alive and receive updated license state.
5. When the application closes, it logs out to release the session.

First Activation vs. Subsequent Use

Archangel behaves differently depending on whether the key has been used before.

Password Authentication

For applications that prefer username and password login over raw license keys, Archangel supports a full registration and login flow.

Registration

1. The end user registers with a valid license key, a chosen username, and a password.
2. Archangel activates the license and creates a user account linked to it.
3. From then on, the user signs in with the registered username and password.

Login Flow

1. The user signs in with a username, password, and optional hardware fingerprint.
2. Archangel validates the credentials, checks the associated license, and returns a signed session.
3. The same heartbeat and logout lifecycle applies as with license authentication.

Multi-Product Accounts (Game Loaders)

Single-product applications use the standard flows above with no additional steps. Multi-product applications, such as game loaders that bundle several titles under one account, allow a single user to hold subscriptions to multiple products at the same time.

Multi-Product Flow

1. The user registers or logs in as usual to establish a session.
2. The user redeems a product key. Archangel validates and activates it, then creates a subscription linking the user to that product with its own start and expiry dates.
3. Redeeming is repeated for each additional product key the user owns.
4. Every heartbeat returns the full list of active subscriptions, so the application always knows which products are available to the user.

Session Management

Archangel tracks every active session on the server. Sessions enforce concurrency limits and feed the anomaly detection engine.

Hardware Binding

Hardware binding ties a license to a specific physical machine, preventing license keys from being shared across devices.

How It Works

1. The client machine computes a composite fingerprint from system identifiers such as CPU, motherboard, disk, and network hardware. Only a SHA-256 hash ever leaves the machine.
2. On first activation, the fingerprint is bound to the license. Subsequent authentication requests are validated against the stored binding.
3. Archangel scores individual hardware components rather than demanding an exact match, so a legitimate component upgrade does not lock a customer out while a completely different machine is still rejected.

Multi-Device Support

Every license has a configurable device limit. When a new device authenticates with a license that has not yet reached its limit, the new fingerprint is added automatically. Once the limit is reached, authentication from unrecognized devices is rejected. Bindings can be reset from the dashboard at any time.

Hardware Change Cooldown

A configurable waiting period between hardware changes can be set per application. Once a license moves to new hardware, further changes are blocked for the configured number of hours. This stops a license from being passed rapidly between machines.

Abuse Visibility

Authentication attempts from unbound devices are recorded as events and feed the anomaly detection engine, giving you a clear view of attempted license abuse directly in the application logs.