Getting Started

Introduction

Protect Your Software. Own Your Distribution.

NEXA Wares is a platform for developers who need license management, verification, and secure software distribution. Whether you're building a game launcher, a desktop app, or a SaaS tool, NEXA Wares gives you the keys to control who uses your software.

Applications are the backbone of the service. Each application stores license keys, tracks user sessions, and manages access through HWID binding, subscription levels, and more.

NEXA Wares is a licensing and authentication service. Clients are still responsible for the security of their overall application.

What can NEXA Wares be used for?

Regardless of the service, NEXA Wares can be used for just about anything, including but not limited to:

Reseller Systems
Game Development
Website Development
PC Applications
Mobile Applications

and more. If the language you work with can make a request, NEXA Wares can be used in it!

Authentication

Every API request needs your API key. Find yours in Settings. Send it in one of two ways:

Header: Authorization: Bearer YOUR_API_KEY
Header: X-API-Key: YOUR_API_KEY

Keep your API key secret. Never expose it in client-side code or public repositories.

Rate Limits

To keep things fair and fast, the following rate limits apply:

API key endpoints: 20 requests per minute
License lookup: 30 requests per minute
Webhook delivery: 5 requests per minute

Exceeding limits returns a 429 Too Many Requests response. Back off and retry.

API Endpoints

GET/api/v1/apps

Returns a list of all your applications.

Field	Type	Description
`name`	string	Application name
`id`	int	Application ID
`secret`	string	Secret key
`app_type`	string	`license`, `verify`, or `json`

POST/api/v1/create_license

Creates one or more licenses for one of your apps.

Parameter	Required	Description
`app_id`	Yes	The ID of the application
`amount`	No	Number of keys to generate (default: 1)
`mask`	No	Custom mask, e.g. `NEXA-****-****`
`note`	No	Internal note for these licenses
`level`	No	Subscription level (default: 1)
`duration`	No	Duration in seconds. Omit for lifetime.

GET / POST /api/v1/license_lookup

Look up a license key and get full details.

Parameter	Required	Description
`app_name`	Yes	The name of your application
`license_key`	Yes	The license key to check
`hwid`	No	Hardware ID to bind or check against

Response includes: status, remaining time, expiry, note, level, HWID state, IP, and more.

License Management

Licenses are the core of NEXA Wares. Each key can have:

Duration — Set a time limit (days, months, years) or make it lifetime.
Level — Tie licenses to subscription tiers for feature gating.
HWID Binding — Lock a license to a specific machine.
Freeze / Ban — Temporarily pause or permanently disable a key.
Note — Add internal notes visible in the dashboard.

Backup & Restore

Export all licenses as a CSV using the Backup button. To restore, click "Load Backup" and upload the CSV. Existing keys are skipped automatically.

HWID Binding

HWID (Hardware ID) locks a license to a specific machine. When a user first activates a key, their HWID is recorded. On subsequent checks, the HWID must match.

Whitelist — Only pre-approved HWIDs can pass auth.
Blacklist — Blocked HWIDs are always denied.
Reset — Reset a bound HWID whenever the license needs to move to another machine.

A CAPTCHA-like widget for your website. Users prove they're human, then you verify the token server-side.

Step 1: Add the Script

<script src="https://nexawares.ir/static/verify.js" async defer></script>

Step 2: Add the Widget

<div class="nexa-verify" data-sitekey="YOUR_SECRET_KEY" data-theme="dark"></div>

Step 3: Verify on Server

POST to https://nexawares.ir/api/siteverify with secret=YOUR_KEY and response=TOKEN.

JSON API

Create a custom JSON endpoint that returns whatever data you want. Set your JSON in Manage App → JSON Configuration.

Your endpoint: https://nexawares.ir/api/json/YOUR_SECRET

Reseller System

Give other users limited license management access for your app.

Max Licenses — Cap how many keys a reseller can create.
Duration Permissions — Control which durations they can create.
Subscription Permissions — Choose exactly which app subscriptions they can use.
View All — Let them see all licenses or only their own.

Webhooks

Get notified in Discord when events happen: license created, used, expired, HWID reset, and more.

Go to Webhooks in the sidebar and add your Discord webhook URL.
Select which events trigger a notification.

License Auth Service

The license authentication service runs at iran.nexawares.ir and handles all client-side verification requests from your applications. It's a separate service from the main panel, designed for low-latency auth checks.

How It Works

Your application communicates with the auth service through a single POST endpoint. The flow is:

1 Initialize — Send a type=init request with your app name and secret. The service creates a session and returns a sessionid.

2 Login / Redeem — Use the session ID to authenticate users via license key or username+password.

3 Session expires — Sessions last 30 minutes. After that, re-initialize.

All requests go to POST https://iran.nexawares.ir/api/1.0. The same endpoint handles every request type — just change the type parameter.

Request Types

POST/api/1.0 type=init

Creates a session. Call this first before any other request type.

Parameter	Required	Description
`type`	Yes	`init`
`name`	Yes	Your application name
`secret`	Yes	Your application secret key

Response: { "success": true, "sessionid": "abc123..." }

POST/api/1.0 type=login

License-only login. Validates the key, checks HWID, and binds the license on first use.

Parameter	Required	Description
`type`	Yes	`login`
`sessionid`	Yes	Session ID from init
`name`	Yes	Your application name
`secret`	Yes	Your application secret key
`license`	Yes	The license key
`hwid`	Yes	Client hardware ID

Possible statuses: valid, invalid, banned, frozen, expired, hwid_mismatch, hwid_blacklisted, hwid_not_whitelisted

POST/api/1.0 type=login_user

Username + password login. Looks up the user's bound license and validates it.

Parameter	Required	Description
`type`	Yes	`login_user`
`sessionid`	Yes	Session ID from init
`name`	Yes	Your application name
`secret`	Yes	Your application secret key
`username`	Yes	NEXA Wares account username
`password`	Yes	NEXA Wares account password
`hwid`	Yes	Client hardware ID

Note: The user must have redeemed a license for this app first. Returns the bound license info and subscription level on success.

POST/api/1.0 type=redeem

Binds a license key to a user account. After redeeming, the user can log in with login_user.

Parameter	Required	Description
`type`	Yes	`redeem`
`sessionid`	Yes	Session ID from init
`name`	Yes	Your application name
`secret`	Yes	Your application secret key
`username`	Yes	NEXA Wares account username
`password`	Yes	NEXA Wares account password
`license`	Yes	The license key to redeem
`hwid`	Yes	Client hardware ID

POST/api/1.0 type=license_info

Check a license key's status without logging in. Useful for quick validation checks.

Parameter	Required	Description
`type`	Yes	`license_info`
`sessionid`	Yes	Session ID from init
`name`	Yes	Your application name
`secret`	Yes	Your application secret key
`license`	Yes	The license key to check

Returns: status (valid, used, unused, banned, frozen, expired), expiry, level, HWID state, and bound user.

App Dashboard

When you set the app type to license, the auth service also provides a management dashboard at iran.nexawares.ir where you can:

View real-time API call charts and auth event logs
See active user sessions for your app
Manage licenses, subscriptions, and HWID rules
Monitor webhook delivery and download activity

The auth service is separate from the main panel. Always use iran.nexawares.ir for client-side auth calls, not nexawares.ir.

Need help? Join our Discord server.