Authentication
Register, sign in and keep end users signed in from inside your app - with Argon2id hashing, heartbeats and revocable sessions.
AroliBuild it. License it. Ship it.
Your software.
Your rules.
Authentication, licensing and distribution, finally in one place.
Manage users, secure your applications, issue licenses and ship software with confidence. Everything your product needs, beautifully connected.
A free plan is available. Upgrade only when your product needs it.
Concrete engineering choices, built in from day one
- Argon2idpassword hashing
- Ed25519signed API responses
- Per-appdevice binding with configurable limits
- Atomiclicense redemption - no double-redeem
- HMAC-hashedlicense keys, plaintext shown once
- Scopedand hashed API keys
- Audit logof every admin action
- HMAC-SHA256signed webhooks
The platform
Everything between “install” and “unlocked”.
Nine building blocks that share one data model, one dashboard and one API - so a license, a device and a subscription always agree with each other.
License management
Generate keys in batches with a prefix, duration and activation limit. Revoke one and only its time is withdrawn.
Device binding
Bind accounts and keys to hardware IDs with a per-app limit. Reset from the dashboard or the API.
Subscriptions
Timed and lifetime entitlements that stack without overlap, freeze and resume, and are checked with one call.
Developer SDKs
TypeScript, Python and C++ clients with stable error codes and built-in response signature verification.
Analytics
Follow your API request volume and see how close you are to your plan limits.
API management
Scoped secret keys for your backend, separate dev and live keys, idempotent writes.
Webhooks
Signed events for registrations, redemptions and entitlement changes, retried with backoff.
Team management
Invite your team with Owner, Admin, Developer, Support and Viewer roles. Every admin action is audited.
The dashboard
Calm, fast and honest about what's happening.
Applications, users, licenses and every API call in one place. Click through the tabs - this preview uses example data.
Demo data
Applications
Applications in the demo organization
| Application | App ID | Status |
|---|---|---|
| Northwind Studio | app_3m9c2r7d | Active |
| Northwind CLI | app_k8x1v4qa | Active |
| Lumen Capture (beta) | app_t2w7n0hs | Paused |
Example data for illustration only. IPs are from documentation ranges.
How it works
Three steps from first install to first license.
No authentication or licensing servers of your own to build, run or patch.
- 01
Create an application
Name your product in the dashboard. Aroli issues a public app ID and an Ed25519 key pair for signing responses, and you choose the device limit.
- 02
Connect your SDK
Install the SDK for TypeScript, Python or C++, pin your app's public key, and call login, redeem and hasEntitlement where your app needs them.
- 03
Manage users and licenses
Generate keys, grant or freeze time, reset devices and ban accounts from the dashboard - or automate it from your backend with the management API.
For developers
A few lines in your app. The rest is ours.
Sign users in, redeem a key, check an entitlement. The SDKs handle response verification and session heartbeats, so your code stays about your product.
main.tsnpm i @aroli/sdk
import { Aroli, AroliError } from "@aroli/sdk";
const aroli = new Aroli({
appId: "app_8f2k1x9q", // public - safe to ship
publicKey: "<your app's Ed25519 key>", // pinned: responses are verified
});
try {
const session = await aroli.login({ username, password, hwid: machineId() });
await session.redeem(licenseKey); // binds the key to this user + device
if (!(await session.hasEntitlement("pro"))) showUpgrade();
session.startHeartbeat(); // keeps the session alive
} catch (err) {
if (err instanceof AroliError && err.code === "device_mismatch") {
showError("This account is linked to another device.");
}
}The app ID is public
app_… identifies your application. It is meant to ship inside your binary - it grants nothing on its own. Secret management keys never belong in client code.
Every response is signed
Client API responses carry an Ed25519 signature over the timestamp, your nonce and the body. The SDK verifies it against the public key you pinned.
Errors are stable string codes
device_mismatch, license_already_redeemed, activation_limit_reached… Branch on the code, show the message. Codes are part of the API contract.
Security
Security you can read in plain language.
No badges, no buzzwords. Here is exactly what Aroli does to protect your accounts, your keys and your customers.
Argon2id for every password
Dashboard accounts and your end users alike. Plaintext passwords are never stored.
Tokens stored only as hashes
Session tokens and API keys are random 256-bit values. We keep only their SHA-256 hash, so stored values can't be used to sign in.
License keys shown once
Keys are stored as HMAC verifiers. You see the plaintext once when generating them; afterwards only a short hint remains.
Signed responses, per-app keys
Each application has its own Ed25519 key pair. Client API responses are signed, and keys can be rotated.
Encryption at rest for secrets
Signing keys, webhook secrets and MFA secrets are encrypted with AES-256-GCM before they reach the database.
Optional two-factor sign-in
Dashboard accounts can enable TOTP-based MFA with one-time recovery codes.
Rate limiting
Sign-in, registration, redemption and validation endpoints are rate-limited per application and IP address.
Tenant isolation on every request
Each request is checked server-side against your organization and application before any data is read or changed.
Role-based access
Owner, Admin, Developer, Support and Viewer roles control who can change what in your organization.
Audit logs
Administrative actions are recorded with who did what and when, so changes are traceable.
Signed webhooks, guarded delivery
Deliveries carry an HMAC-SHA256 signature. Endpoints must be public HTTPS; private and loopback addresses are rejected.
What Aroli can’t do for you
Device fingerprints are supplied by the client, so a determined attacker can spoof them. Aroli enforces device and activation limits on the server, signs every response and keeps secrets out of your binary - but no service can make software running on someone else’s machine uncrackable. We'd rather tell you that up front.
Pricing
Start free. Grow into it.
Simple plans with clear limits. Pay monthly or save with longer billing intervals.
Free
Everything you need to build and test your first integration.
0 €/ monthNo charge
Start for free- Authentication & license keys
- Device binding
- Signed client API
- Community support
Starter
For independent developers shipping their first paid product.
9 €/ monthBilled monthly
Choose Starter- Everything in Free
- Webhooks
- Application variables
- Management API keys
- Email support
Pro
RecommendedFor products with a growing customer base and a small team.
24 €/ monthBilled monthly
Choose Pro- Everything in Starter
- Team roles & audit logs
- Subscription freezing & stacking
- Priority email support
Business
For established software companies with many products.
59 €/ monthBilled monthly
Choose Business- Everything in Pro
- Unlimited end users
- Higher API volume
- Onboarding call
Prices shown are provisional and may change before general availability. Pay in euros or US dollars from your prepaid Aroli balance; taxes may apply.
Compare all plan limitsReady to ship with confidence?
Create an application, connect an SDK and issue your first license key. The free plan has everything you need to build and test your integration.