Architecture

PureAuth is a multi-tenant SaaS. Developers create applications. End users authenticate with username/password, license keys, tokens, or hardware IDs. All expiry, ban, quota, and HWID checks run in the Go API.

Client applications never receive a “seller key”. They sign requests with HMAC-SHA256 using the app secret. Dashboards and automations use JWT or scoped API keys.

Identities

• Platform accounts — you, paying for PureAuth
• Team members — RBAC inside an organization
• App customers — users/licenses inside an application

PureAuth is not an obfuscator. Protect your binary separately.