Docs — Dark Broken Key

Documentation

Integration guide

Everything your software sends goes to one endpoint as JSON. Your deployment's base URL is this site's origin — for example https://your-site.pages.dev — and the client API lives at POST /api/v1.

Credentials concept

Your software identifies its application with three public values, shown in your dashboard under Overview → Credentials:

name — the application name you created (exact, case-sensitive).
ownerid — your developer owner ID (the same for all of your applications).
version — the application version. If it does not match the dashboard, init fails and the message tells the user the required version. Bump the dashboard version to force updates.

These values are not secrets — they only select the application. The real secret is your Seller Key, which must never be embedded in a client application (see Seller API below).

Client API — POST /api/v1

Every request is a JSON body with type, name and ownerid, plus the fields for that type. Every response is JSON with success (boolean), message, and on success an info object and often a sessionid.

Type	Extra fields	What it does
init	version (optional)	Handshake. Fails if the app is paused or the version mismatches. Returns app info, user/key counts.
register	username, pass, key, hwid	Creates an end-user by consuming an unused license. Binds the HWID, sets expiry from the license duration, returns a session.
login	username, pass, hwid	Verifies credentials, ban and expiry, enforces the HWID lock, returns a session.
license	key, hwid	Key-only login. An unused key is activated on first use; later uses must match the bound HWID.
check	sessionid	Validates an existing session (also re-checks ban and expiry server-side).
var	sessionid, varid	Fetches a server-side variable by name. Requires a valid session — secrets never ship with your binary.

Example — init

POST /api/v1
{ "type": "init", "name": "MyApp", "ownerid": "AB12CD34EF", "version": "1.0" }

→ { "success": true, "message": "Initialized",
    "info": { "name": "MyApp", "version": "1.0", "numUsers": 3, "numKeys": 25, "numOnline": 1 } }

Example — register with a license

POST /api/v1
{ "type": "register", "name": "MyApp", "ownerid": "AB12CD34EF",
  "username": "rahim", "pass": "secret123",
  "key": "MYAPP-XXXXX-XXXXX-XXXXX-XXXXX", "hwid": "PC-HWID-123" }

→ { "success": true, "message": "Registered successfully",
    "sessionid": "9f2c…", "info": { "username": "rahim", "expires_at": "2026-11-23T…Z", "hwid": "PC-HWID-123" } }

Example — login + server variable

POST /api/v1
{ "type": "login", "name": "MyApp", "ownerid": "AB12CD34EF",
  "username": "rahim", "pass": "secret123", "hwid": "PC-HWID-123" }

→ { "success": true, "sessionid": "ab41…", "info": { "username": "rahim", "expires_at": "…" } }

POST /api/v1
{ "type": "var", "name": "MyApp", "ownerid": "AB12CD34EF",
  "sessionid": "ab41…", "varid": "welcome" }

→ { "success": true, "info": { "value": "https://…" } }

SDK downloads

Small, dependency-free client classes that wrap every call above. Set BASE_URL, name and ownerid at the top of the file and go:

darkbrokenkey.py — Python 3 (urllib only)
darkbrokenkey.js — JavaScript / Node 18+ (fetch)
darkbrokenkey.php — PHP (cURL)
darkbrokenkey.cs — C# (.NET, HttpClient)
darkbrokenkey.cpp — C++ (libcurl, minimal JSON helpers)

Seller API

For your own servers, shops and bots only — never ship the Seller Key inside a client app. Available on Developer and Seller plans. Send your key as a header:

X-Seller-Key: sk_…your key from Dashboard → Seller API & Docs…

Endpoint	Body	Effect
POST /api/seller/licenses	{ appId, days, amount, prefix }	Generates licenses for one of your applications.
POST /api/seller/ban	{ appId, username, ban }	Bans or unbans an end-user (ban also kills their sessions).
POST /api/seller/reset-hwid	{ appId, username }	Clears the user's HWID binding so they can log in on a new machine.
POST /api/seller/extend	{ appId, username, days }	Extends a user's subscription by N days.

All Seller API calls are scoped to applications owned by the key's developer — a key can never touch another developer's data.

HWID explanation

The HWID is any stable machine identifier your software computes (for example a hash of the motherboard/disk serial, or Windows MachineGuid). On first login or registration it is stored; later logins from a different HWID fail with Invalid HWID. If a user legitimately changes PC, reset their HWID from Dashboard → Users → Reset HWID (or via the Seller API) and they can bind the new machine on next login.

Customer Panel (for your end-users)

Every application gets a self-service panel for its end-users at /customer.html (the link is also shown in your dashboard's Credentials box). A customer logs in with four things: your application name, your owner ID, and their own username + password — the same account your software uses. Inside they can see their subscription status and expiry, the HWID their account is bound to, and change their password.

Self-service HWID reset: customers can reset their own HWID binding when they change PC. You control how often: Dashboard → Applications → "Customer HWID resets / mo" (default 2 per calendar month). When the monthly limit is reached the reset button is disabled until the next month; you can always reset manually from Dashboard → Users.

Reseller Portal (Seller plan)

On the Seller plan you can create reseller accounts per application (Dashboard → Resellers). Each reseller gets a login at /reseller.html with the app name, your owner ID and the username/password you created. In the portal a reseller can:

Generate keys — each key costs 1 credit from their balance (top them up from your dashboard). Key duration can not exceed the max days you set for that reseller.
See only their own keys — keys are scoped per reseller; other resellers and your dashboard keys stay separate (dashboard-generated keys are still all visible to you in Dashboard → Licenses).
Change their password.

You can ban a reseller at any time from the dashboard (their portal access and sessions are revoked immediately) and delete accounts you no longer need.

Telegram Bot (Developer & Seller plans)

Manage your applications from Telegram with your own bot:

Message @BotFather in Telegram, send /newbot and copy the bot token.
Message @userinfobot and copy your numeric Telegram user ID — the bot only accepts commands from this account; everyone else is ignored.
In your dashboard open Telegram Bot, paste the token + user ID and save.
Open the setWebhook link shown there. Telegram should reply {"ok":true,"result":true}.

Commands (app name is one word, matched case-insensitively):

Command	What it does
`/apps`	List your applications with user/license counts.
`/gen MyApp 30 5`	Generate 5 keys of 30 days for MyApp and reply with the keys.
`/ban MyApp user` / `/unban MyApp user`	Ban or unban an end-user.
`/resethwid MyApp user`	Clear the user's HWID binding.
`/extend MyApp user 30`	Add 30 days to the user's subscription.
`/userinfo MyApp user`	Show status, expiry and bound HWID.

Password reset & email verification (developer accounts)

Developers who forget their password use /forgot.html (linked from the login page). A reset link is created that expires after 30 minutes and works once; resetting also signs out all existing dashboard sessions. New developer accounts also receive an email-verification link (valid 24 hours); the verification status is shown in Dashboard → Settings, where a new link can be requested.

How the link reaches the developer depends on the platform's email setup: if the platform owner configured Resend (API key + from address in the owner panel), links are emailed automatically. If not, no email is sent — the owner can reveal the pending link in the owner panel's Access Links tab and send it to the developer manually (Telegram/WhatsApp). Either way the flow is identical for the developer.

Common error messages

Message	Meaning
Application not found	Wrong `name`/`ownerid` pair, or the developer account is banned.
Application paused	The developer paused this app in the dashboard.
Invalid version — … requires version X	Client version mismatch; update the software (or the dashboard version).
License not found / already used / banned / expired	The key does not exist in this app, was consumed by a registration, was banned, or its duration ended.
Invalid HWID	The account/key is bound to another machine. Reset the HWID from the dashboard.
Subscription expired	The user's paid period ended. Extend from Dashboard → Users.
User banned	The end-user was banned by the developer.
Invalid session	The session ID is unknown, belongs to another app, or the user was banned after login.
Unknown type	The `type` field is not one of the supported client API types.

Integration checklist

Call init first, before any other type — and handle the version-mismatch message.
Never hardcode your Seller Key in a client application — Seller API calls belong on your server.
Call check periodically for long-running apps, so bans and expiries take effect.
Keep valuable strings/files behind var instead of embedding them in the binary.
Combine with an obfuscator/packer if needed — this service is authentication, not code protection.