How to use the official System Locker C++ library

If you are starting a new C++ integration for software that runs on customer hardware, use the official System Locker Bedrock C++ library on GitHub. It is the preferred option over hand-writing the protocol: it verifies signed responses, generates fresh challenges, runs the heartbeat session for you, and exposes the supported Bedrock APIs through one C++20 client.

1. Choose your integration path

The official repository supports two paths. Both use the same public C++ API, validate Bedrock responses, and maintain the heartbeat session. For production applications, we recommend source embedding: compile the System Locker implementation as part of your own build instead of linking a prebuilt package.

Clone or download systemlocker/System-Locker-Bedrock-CPP. Use a C++20 project and build your application and dependencies for the same architecture, normally x64.

2. Add the code (source embed only)

Copy or vendor include/syslocker/, src/, and third_party/nlohmann/json.hpp into a stable folder in or beside your solution. Keep the private headers in src/ beside the implementation files. This is the recommended route: your application compiles the Bedrock implementation directly instead of linking a prebuilt library.

These steps refer to the current Visual Studio C++ Property Pages. If you do not have a C++ project or do not see the C/C++ and Linker sections below, install the Desktop development with C++ workload from Visual Studio Installer first.

Add the implementation files

1. Open View > Solution Explorer if it is not already visible.
2. Right-click your application project (the .vcxproj node, not the top-level solution), then click Add > Existing Item….
3. Browse to the vendored src/ folder, select every .cpp file, then click Add. Do not add the headers merely to satisfy the compiler; they remain beside the source files and are found through their local includes.

Visual Studio's Add Existing Item command adds existing files to the selected project. Repeat this only when the library adds a new .cpp file in a future update.

Set C++20 and the x64 build target

1. In Solution Explorer, right-click the application project and click Properties. Do not open properties from the solution node: the C++ build settings belong to the project.
2. At the top of Property Pages, select All Configurations so Debug and Release receive the same setting. Select x64 as the platform when using the Windows static package; its architecture must match your application.
3. Click Configuration Properties > C/C++ > Language. Set C++ Language Standard to ISO C++20 Standard (/std:c++20).

Microsoft documents /std:c++20 as the C++20 option, and the System Locker library requires C++20. If your project does not offer that selection, update the installed MSVC toolset rather than choosing /std:c++latest.

Click through the include and linker settings

Stay in the same Property Pages window. For each property, click its value field, use the drop-down arrow, then choose <Edit…> to add entries without removing inherited settings.

C/C++ > General > Additional Include Directories
path\to\include
path\to\third_party\nlohmann

Linker > General > Additional Library Directories
path\to\libcurl-and-openssl\lib

Linker > Input > Additional Dependencies
libcurl.lib;libcrypto.lib;zs.lib;bcrypt.lib;advapi32.lib;
crypt32.lib;secur32.lib;ws2_32.lib;iphlpapi.lib;user32.lib

ws2_32.lib comes from the Windows SDK, so do not redistribute it. Click Apply, then OK, and choose Build > Build Solution. If you see a missing-header error, recheck C/C++ > General; if the linker cannot find a library, recheck Linker > General before changing the dependency list. The repository's README is the authority for dependency versions and platform-specific names.

or, use the static package

If you need the fastest Windows setup, the Bedrock repository also includes a static/ package. Use the same project-level Properties window and select All Configurations and x64. Then follow the package's STATIC-LIBRARY.md instructions for its include and library directories.

3. Authenticate with a key

Create one syslocker::bedrock::Client for the system and authenticated user. Configure it with the System ID, the Bedrock signing public key from your developer dashboard, the application version, and a hardware identifier. Leave Config::hwid empty to opt into SL-HWID, provide a stable custom value, or use 1 only when you deliberately disable device locking.

#include <syslocker/bedrock.hpp>
#include <iostream>

int main()
{
    syslocker::bedrock::Config cfg;
    cfg.systemId = "YOUR_SYSTEM_ID";
    cfg.version = "1.0.0";
    cfg.hwid = "YOUR_STABLE_HWID";
    cfg.signingPublicKey = "YOUR_BASE64URL_RAW_ED25519_PUBLIC_KEY";

    syslocker::bedrock::Client client(cfg);
    client.onHeartbeatFailure([](const auto& failure) {
        DisableProtectedFeatures();
        ShowAccessError(failure.error.message);
    });

    const auto result = client.authenticateWithKey("YOUR_LICENSE_KEY");
    if (!result || !result->sessionStarted) {
        std::cerr << "Authentication failed\n";
        return 1;
    }

    // Enable protected features only after authentication succeeds.
    RunProtectedApplication(client);
}

For account authentication, call authenticateWithPassword(username, password) instead. The client validates the signed response, challenge, identity, and session state before it reports success, so application code does not need to parse the protocol itself.

4. Respond to a lost session

After a successful authentication, the library starts and maintains the background Bedrock heartbeat session. Install a failure hook before or after authenticating so your application can close protected features, save work, or show an access message when the session can no longer continue. Keep the hook quick and do not throw from it.

client.onHeartbeatFailure([](const auto& failure) {
    // Switch to your UI thread if your framework requires it.
    DisableProtectedFeatures();
    ShowAccessError(failure.error.message);
});

if (!client.isAuthenticated()) {
    DisableProtectedFeatures();
}

The default beat rate is 30 seconds and can be configured from 25 to 3,600 seconds. The library rotates the server token internally, including the state needed for the next heartbeat. Shut the client down when your protected session ends and keep its in-memory session state out of persistent storage.

5. Keep production configuration deliberate

Pin the Bedrock signing public key that you retrieved through a trusted dashboard session, and coordinate key rotation with an application update. Test signature failures, stale sessions, and revoked keys as carefully as successful launches.

For Linux and macOS, use a C++20 compiler, libcurl, OpenSSL Crypto, and the vendored JSON header. Follow the repository README for the platform-specific linker setup.

When your project grows

The same Bedrock client provides Variables and, when configured with an API key, Invisible Folder access. Review the repository README for the full setup and API surface, then make each protected feature depend on the live authenticated session rather than on a one-time startup check.

Ready to use System Locker in your C++ app?

Create a system, download the official library, and protect a small C++20 application before scaling up.

Get Basic for $2/month Open C++ library on GitHub