Loader Builder

Build custom loader executables directly from the dashboard or API. No compiler needed — your credentials are embedded into a pre-compiled template.

How it works

The builder takes a pre-compiled loader template and patches in your App ID, API Key, and configuration. The output is a standalone .exe ready for distribution to your users.

Overview

The Loader Builder produces native Windows executables that:

  • Connect to Authon API and initialize your application
  • Present a login/register/license authentication menu
  • Validate HWID to prevent sharing
  • Optionally download and execute a protected file after auth
  • Include basic anti-debug protection

C++

Native Win32 / WinHTTP

Available

C#

.NET Framework

Coming Soon

Python

PyInstaller bundle

Coming Soon

Building from Dashboard

The easiest way to build a loader. Navigate to Dashboard → Builder and configure:

ApplicationSelect which app the loader authenticates against
LanguageChoose the template language (C++ recommended)
Auth Type'login' (username/password), 'license' (key only), or 'both' (menu)
TitleConsole window title shown to the user
File IDOptional - file to download and execute after successful auth

Click "Build" and the .exe will download immediately.

Building via API

You can also build loaders programmatically using the Builder API:

Build a loader
cURL
curl -X POST https://api.authon.pro/v1/builder/build \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{
    "appId": "your-app-id",
    "language": "cpp",
    "title": "My App Loader",
    "authType": "both",
    "fileId": "optional-file-id"
  }' \
  --output loader.exe

Request Parameters

appIdstringrequiredApplication ID to embed in the loader
languagestringoptionalTemplate language: 'cpp' (default) or 'csharp'
titlestringoptionalWindow title (default: 'Authon Loader')
authTypestringoptional'login', 'license', or 'both' (default: 'both')
fileIdstringoptionalFile to auto-download after auth (leave empty to skip)

Authentication Types

authType: "both"Default

Shows a menu with both login and license options:

[1] Login
[2] License Key

Choice: _
authType: "login"

Goes directly to username/password prompt:

Username: _
Password: _
authType: "license"

Goes directly to license key prompt:

License Key: _

File Loading (Optional)

If you specify a fileId, the loader will download the file after successful authentication and execute it:

Flow with File Loading

  1. User authenticates (login or license)
  2. Loader downloads the file from /v1/files/download/{fileId}?token={session}
  3. File is written to temp directory
  4. File is executed via ShellExecute

Important

The file must be uploaded to your app first (Dashboard → Files). The user's level must be ≥ the file's minimum level requirement.

How Binary Patching Works

The builder works by replacing placeholder strings in the compiled template binary with your actual values:

Placeholder tokens in template
C++
// These are compiled into the template binary:
static const char AUTHON_APP_ID[]   = "%%AUTHON_APP_ID_PLACEHOLDER_00000000%%";
static const char AUTHON_API_KEY[]  = "%%AUTHON_API_KEY_PLACEHOLDER_00000000%%";
static const char AUTHON_FILE_ID[]  = "%%AUTHON_FILE_ID_PLACEHOLDER_000000%%";
static const char AUTHON_TITLE[]    = "%%AUTHON_TITLE_PLACEHOLDER_000000000%%";
static const char AUTHON_AUTH_TYPE[] = "%%AUTHON_AUTH_TYPE%%";

The server reads the template binary, finds these placeholder strings, and replaces them with your values (null-padded to maintain binary size). This means the output is a valid executable with no compilation step needed.

Security Considerations

Anti-Debug

Built-in checks for IsDebuggerPresent and CheckRemoteDebuggerPresent. The loader exits if a debugger is detected.

HWID Binding

Automatically generates and sends a hardware ID based on the volume serial number. Prevents account/license sharing.

API Key in Binary

Your API key is embedded in the binary. While it can be extracted by reverse engineering, the API key only grants client-level access (not admin). For additional security, enable IP whitelisting.

Key Regeneration

If you suspect your API key is compromised, regenerate it from the dashboard. This will invalidate all existing loaders — you'll need to build a new one.

Check Builder Status

Verify the builder service is operational and templates are available:

Check status
cURL
curl -X GET https://api.authon.pro/v1/builder/status \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"