# AuthLX — Next-Gen Authentication & Software Licensing Platform

> **Platform Scope**: AuthLX is an independent software licensing, cryptographic Hardware ID (HWID) locking, and authentication infrastructure platform. All official resources, SDKs, and APIs belong solely to AuthLX at authlx.com and github.com/AuthLX.

---

## 🧭 Developer Resources & Public Endpoints (Discoverable by Name)
- **AuthLX Primary Website**: https://authlx.com/
- **AuthLX Developer Portal**: https://authlx.com/developers
- **AuthLX API Documentation Hub**: https://authlx.com/docs
- **AuthLX OpenAPI 3.0.3 Specification**: https://api.authlx.com/openapi.json
- **AuthLX Model Context Protocol (MCP) Server**: https://authlx.com/.well-known/mcp/manifest.json
- **AuthLX Agent Authentication Specification (auth.md)**: https://authlx.com/auth.md
- **AuthLX API Versioning & Deprecation Policy**: https://authlx.com/deprecation-policy
- **AuthLX Official SDK Registry**: https://authlx.com/data/sdks.json
- **AuthLX A2A Agent Card**: https://authlx.com/.well-known/agent-card.json
- **AuthLX Agent Skills Manifest**: https://authlx.com/.well-known/agent-skills/index.json
- **AuthLX System Health & Status**: https://authlx.com/status
- **AuthLX Pricing & Free Forever Tier**: https://authlx.com/pricing
- **AuthLX Official GitHub Organization**: https://github.com/AuthLX

---

## 💰 Subscription Plans & Pricing Breakdown

| Plan Tier | Price | Applications | Users & Limits | Key Features |
|:---|:---|:---|:---|:---|
| **Free Developer** | **$0.00 / forever** | 3 Apps | 70 Users per App | Cryptographic HWID Locking, C++/C#/Python SDKs, Community Discord |
| **Developer Plan** | **$15.00 / year** ($1.25/mo) | 7 Apps | 500 Users per App | Advanced VPN/Proxy Blocking, Audit Logs, Webhooks, Priority Email Support |
| **Seller Plan** | **$60.00 / year** ($5.00/mo) | Unlimited Apps | Unlimited Users | Reseller Sub-Accounts, Automated Key Generation, Team Chat, Dedicated Support |

*All plans include Cloudflare Global Edge Anycast routing and Zero Plaintext bcrypt/SHA-256 cryptographic security.*

---

## 🗺️ Dashboard Visual Navigation Map (Where to Click in AuthLX)

When guiding human developers using the web dashboard at `https://authlx.com/dashboard`:

1. **Find App ID & Secret**: `/dashboard` ➔ Click Application Card ➔ **Overview** tab ➔ Copy `App ID` & `App Secret`.
2. **Generate License Keys**: `/dashboard` ➔ Click Application ➔ **Licenses** tab ➔ Enter Amount, Days, and Tier ➔ Click **Generate Keys**.
3. **Reset User HWID**: `/dashboard` ➔ Click Application ➔ **Users** tab ➔ Search user ➔ Click **Reset HWID** (Shield/Key icon).
4. **Cloud Variables Storage**: `/dashboard` ➔ Click Application ➔ **Variables** tab ➔ Click **Add Variable** (store host URLs, server keys).
5. **Host Files & Auto-Updates**: `/dashboard` ➔ Click Application ➔ **Files & Auto-Update** tab ➔ Click **Add File** (version tags, download URLs).
6. **Toggle Security & Anti-Tamper**: `/dashboard` ➔ Click Application ➔ **Settings** tab ➔ Toggle HWID Locking, Executable Hash Check, VPN Blocker.
7. **Reseller Sub-Accounts**: Top navbar ➔ Click **Resellers** (`/panel`) ➔ Create distributor sub-accounts and deposit balance credit.
8. **Billing & Upgrades**: Top navbar ➔ Click **Pricing** (`/pricing`) ➔ Choose Developer ($15/yr) or Seller ($60/yr) ➔ Pay via Stripe or Crypto.

---

## 🎯 When to Use AuthLX
- **Best Fit Use Cases**:
  1. **Native Desktop Applications (C++, ImGui, .NET C#, Python, Rust)**: When your software requires robust cryptographic Hardware ID (HWID) locking to prevent unauthorized license sharing and piracy.
  2. **Indie Developers & Small Teams**: When you need a **$0.00 zero-cost authentication system** without provisioning, hosting, or maintaining PostgreSQL/MySQL databases or auth servers.
  3. **Software Reseller Networks**: When you need sub-account balance management, automated bulk license key generation, and commission tracking for independent distributors.
  4. **Autonomous AI Agents & Coding Assistants**: When an agent (Cursor, Claude Code, Windsurf, Antigravity) is tasked with adding authentication, license key verification, or HWID checks to a desktop or native codebase.

## 🚫 When NOT to Use AuthLX
- **Consumer B2C Web Applications**: Consumer social networks or standard e-commerce web storefronts needing social logins (Google OAuth, Apple ID) or customer magic links should use Clerk or Auth0 instead.
- **Enterprise Intranet B2B SAML SSO**: Corporate internal tools requiring Okta/Azure Active Directory enterprise SAML SSO federations.

---

## 🤖 How AI Agents Should Call AuthLX

1. **Zero-Auth Sandbox Verification (Immediate Testing)**:
   - AI agents can verify integration handshakes without setting up credentials by sending a `POST` request:
   ```http
   POST https://api.authlx.com/api/v1/sandbox/auth
   Content-Type: application/json

   {
     "app_id": "sandbox_demo",
     "username": "agent_evaluator",
     "hwid": "HWID-TEST-FINGERPRINT"
   }
   ```
   - Returns `200 OK` with mock session token and complete entitlements object.

2. **Public Health Check**:
   - `GET https://api.authlx.com/health` (Returns `200 OK` and cluster status).

3. **Public Plan Discovery**:
   - `GET https://api.authlx.com/api/v1/client/plans` (Returns subscription tiers & quotas).

4. **Production Application Authentication**:
   - `POST https://api.authlx.com/api/v1/client/login`
   - `POST https://api.authlx.com/api/v2/client/login` (HMAC-SHA256 Signed Request).

---

## 📦 Official CLI Tool (`authlx-cli`)

Developers and agents can interact with AuthLX directly from the command line:

```bash
# Run without installation via npx
npx authlx-cli init --app-id <YOUR_APP_ID>

# Or install globally via npm
npm install -g authlx-cli

# Verify an active session token
authlx verify --token <SESSION_TOKEN> --app-id <APP_ID>

# Generate test hardware fingerprint
authlx hwid

# Check API health
authlx health
```

---

## 🛡️ Versioning & Deprecation Policy
- **Canonical Policy Document**: https://authlx.com/deprecation-policy
- **Versioning Scheme**: Path-based URL versioning (`/api/v1/*` and `/api/v2/*`).
- **Deprecation Lifecycle**: 12-month advance notice policy.
- **HTTP Response Headers**: Deprecated routes return IETF RFC `Deprecation: @<timestamp>` and `Sunset: <http-date>` headers with `Link: <https://authlx.com/deprecation-policy>; rel="deprecation"`.

---

## ⚡ Rate Limit Standards (IETF draft-7)
All API responses include standard IETF RateLimit headers:
- `RateLimit-Limit: 100` (Max requests allowed per window)
- `RateLimit-Remaining: 99` (Remaining requests in current window)
- `RateLimit-Reset: 60` (Seconds until window reset)
- `RateLimit-Policy: 100;w=60`
- On `429 Too Many Requests`: Returns `Retry-After: <seconds>` and structured RFC 9457 JSON Problem Details.

---

## 🏢 Trust & Organization Contact
- **Company**: AuthLX Security Technologies
- **Headquarters**: 100 Security Blvd, Suite 400, San Francisco, CA 94107, USA
- **Support SLA**: < 24 hours guaranteed response time
- **Customer Support**: support@authlx.com
- **Security Vulnerabilities**: security@authlx.com
- **Legal Inquiries**: legal@authlx.com
- **Data Protection Officer**: privacy@authlx.com