Bedrock, our best authentication API yet

Bedrock is System Locker's new production authentication API for software licensing. It authenticates an account or license key, returns signed JSON your client can verify, and keeps the session alive with heartbeats and rotating session tokens.

Setting a price on your software puts a target on your back, and shipping that software to users creates an opening. System Locker's job is to make an adversary's job as hard as possible. This post covers why Bedrock replaced Quicksilver, what its security model adds, and how to integrate the API.

Bedrock fits into a layered security approach. It decides who can run your software and on which machine, while Aegis flags suspicious patterns that only show up across your logs. The Bedrock API reference has the complete request and response fields; the guide below shows the shape of a working client.

From Quicksilver to Bedrock

Quicksilver established the session model: authenticate once, then send lightweight heartbeats for as long as the program runs. Bedrock keeps that contract, along with hardware locking, version checks, Program Hash enforcement, and the heartbeat timing baseline.

The newer API replaces the old response format with signed JSON, adds a fresh client-generated challenge to every request, and rotates the session token after each accepted heartbeat. Quicksilver remains available for existing integrations, but Bedrock is the production API we recommend for new ones. We plan to phase out Quicksilver at some point in 2027.

Why Bedrock is stronger

A fake server can answer every question with "yes" if the client trusts unsigned responses. Bedrock signs every response with an Ed25519 key that's unique to your system. The client verifies that signature with the public key bundled in the application before it parses or trusts the JSON. Rejections are signed too, so an impostor cannot forge a convincing success or failure.

Signatures identify the server. Fresh client-generated challenges bind each response to each request, so a response captured yesterday cannot be replayed today. Bedrock stores challenge values long enough to reject reuse. That gives it stronger replay protection than a client timestamp, which depends on a clock an attacker can change.

The protocol is easier to operate as well: responses use structured JSON and consistent response codes, sessions have no artificial expiry, and each accepted heartbeat replaces the session token. If a response is lost, the client retries the immediately previous token with the same challenge once, and Bedrock returns the cached signed response. Server-side variables can be returned in that same signed response.

How to integrate the Bedrock authentication API

A Bedrock client has four jobs: initialize a session, verify the signed response, keep the session alive, and stop access when the API returns a terminal response. The endpoints use HTTP POST requests. Choose account authentication with username and password, or key-only authentication with key. Do not send both credential forms.

1. Initialize a session

Send your system ID, hardware ID, and a fresh challenge to /auth/bedrock/init. Include version when your system checks versions, digest when it uses Program Hash, and beatrate when you want a specific interval.

POST https://systemlocker.net/auth/bedrock/init
Content-Type: application/x-www-form-urlencoded

system=YOUR_SYSTEM_ID&key=YOUR_LICENSE_KEY&hwid=YOUR_HWID
&version=1.0.0&beatrate=30&challenge=FRESH_RANDOM_VALUE

Challenges must be fresh printable-ASCII strings from 64 to 100 characters. Generate one for every request, and use a cryptographically secure random source. The Bedrock documentation lists every field, response code, and optional value such as variables or init-if.

2. Verify before parsing

The response body is one base64url value containing a 64-byte Ed25519 signature followed by the exact JSON payload. Verify the signed bytes with your system's public key before reading any response fields, then confirm that the echoed challenge matches the request.

signed = base64url_decode(response.body)
signature = signed[0:64 bytes]
payload = signed[64 bytes:]

if !ed25519_verify(signature, payload, SYSTEM_PUBLIC_KEY):
    reject()

result = parse_json(payload)
if result.challenge != request.challenge:
    reject()

Treat response_code as the source of truth. OK and OUTDATED indicate a successful authenticated response; how you handle outdated versions is up your decision. Our recommendation is to download the latest version of your application from Invisible Folder's API.

3. Keep the session alive

After a successful initialization, send the returned session_token, your system ID, and a new challenge to /auth/bedrock/beat every heartbeat interval. Replace the stored token with the one new one contained in each successful response. Stop access when the response code reports a terminated, stale, early, revoked, or otherwise invalid session.

POST https://systemlocker.net/auth/bedrock/beat
Content-Type: application/x-www-form-urlencoded

system=YOUR_SYSTEM_ID&session_token=LATEST_TOKEN
&challenge=FRESH_RANDOM_VALUE

If the network drops a heartbeat response, repeat the immediately previous token with the same challenge during the next interval. Bedrock returns the exact cached response once. Changing the challenge or waiting too long invalidates that retry.

Or, start with the reference implementation

The fastest way to get a production client running is the Bedrock C++ reference implementation. Embed its source in your project so it compiles with the rest of your code and receives the same obfuscation and build protections. The Bedrock API reference also links to the .NET, Node.js, Python, and Go implementations.

Our complete security platform

Once you sell a key to your program, Invisible Folder protects the files you distribute and lets you push updates. Bedrock decides who gets to run them, on which machine, and for how long. Aegis watches your logs for the patterns no single request can reveal, like a handful of keys appearing across hundreds of machines. Each layer covers the blind spots of the others.

System Locker continues to build the tools that developers actually need, and we're doing it with a focus on security. Our mission is to provide a proper licensing, authentication, and security platform for developers, so they can focus on building their software instead of fighting attacks.

Quicksilver will be phased out during 2027, so Bedrock is the production-ready API we recommend going forward. As the security landscape shifts, we'll keep giving developers better tools to protect their software and their business.

Ready to build on Bedrock?

Bedrock is only available on paid plans. Get started for $5 once, or $2/month. Still deciding? Talk through your setup with us on Discord.

Unlock Bedrock for $2/month Join Discord