API Reference & Client SDKs

#include <iostream>
#include <winhttp.h>
#include <vector>
#include <string>

#pragma comment(lib, "winhttp.lib")

// Compile-Time XOR String Encryption Engine
// Hides all API URLs, App IDs, headers, and strings from x64dbg / IDA Pro String View
template <size_t N, char K = 0x6A>
class XorString {
private:
    char m_data[N];
public:
    constexpr XorString(const char(&str)[N]) {
        for (size_t i = 0; i < N; ++i) m_data[i] = str[i] ^ K;
    }
    std::string decrypt() const {
        std::string res; res.resize(N - 1);
        for (size_t i = 0; i < N - 1; ++i) res[i] = m_data[i] ^ K;
        return res;
    }
};
#define XOR_STR(str) (XorString<sizeof(str)>(str).decrypt())

struct LicenseResponse {
    bool success;
    std::string status;
    std::string authSig;
};

LicenseResponse ActivateLicenseEncrypted(const std::string& appId, const std::string& key, const std::string& hwid) {
    // Encrypted strings - decrypted dynamically only in RAM during execution
    std::wstring wHost = std::wstring(XOR_STR("deliadevelopment.com").begin(), XOR_STR("deliadevelopment.com").end());
    std::wstring wPath = std::wstring(XOR_STR("/api/v1/license/activate").begin(), XOR_STR("/api/v1/license/activate").end());

    HINTERNET hSession = WinHttpOpen(L"DeliaSecClient/1.0", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, NULL, NULL, 0);
    HINTERNET hConnect = WinHttpConnect(hSession, wHost.c_str(), INTERNET_DEFAULT_HTTPS_PORT, 0);
    HINTERNET hRequest = WinHttpOpenRequest(hConnect, L"POST", wPath.c_str(), NULL, NULL, NULL, WINHTTP_FLAG_SECURE);

    std::string jsonBody = "{\"" + XOR_STR("appId") + "\":\"" + appId + "\",\"" + XOR_STR("license") + "\":\"" + key + "\",\"" + XOR_STR("deviceId") + "\":\"" + hwid + "\"}";
    std::wstring headers = L"Content-Type: application/json\r\n";

    BOOL sent = WinHttpSendRequest(hRequest, headers.c_str(), (DWORD)headers.length(), (LPVOID)jsonBody.c_str(), (DWORD)jsonBody.length(), (DWORD)jsonBody.length(), 0);
    if (!sent || !WinHttpReceiveResponse(hRequest, NULL)) return { false, "", "" };

    std::string resp; char buffer[1024]; DWORD bytesRead = 0;
    while (WinHttpReadData(hRequest, buffer, sizeof(buffer) - 1, &bytesRead) && bytesRead > 0) {
        buffer[bytesRead] = 0; resp += buffer;
    }

    WinHttpCloseHandle(hRequest); WinHttpCloseHandle(hConnect); WinHttpCloseHandle(hSession);

    bool success = resp.find(XOR_STR("success\":true")) != std::string::npos;
    bool hasSig = resp.find(XOR_STR("authSig")) != std::string::npos;
    return { success && hasSig, success ? "active" : "failed", "VERIFIED_HMAC" };
}

int main() {
    auto res = ActivateLicenseEncrypted(XOR_STR("YOUR_APP_ID"), "DELIA-XXXX-XXXX-XXXX", "USER_HWID_123");
    if (res.success) {
        std::cout << XOR_STR("[+] License Verified & HMAC Authenticated!") << std::endl;
    } else {
        std::cout << XOR_STR("[!] Authentication Failed.") << std::endl;
    }
    return 0;
}

using System;
using System.Net.Http;
using System.Text;
using System.Text.Json;
using System.Threading.Tasks;

public class DeliaLicensing
{
    private static readonly HttpClient client = new HttpClient();

    public static async Task<bool> ActivateAsync(string appId, string licenseKey, string hwid)
    {
        var payload = new { appId = appId, license = licenseKey, deviceId = hwid };
        var content = new StringContent(JsonSerializer.Serialize(payload), Encoding.UTF8, "application/json");

        var response = await client.PostAsync("https://deliadevelopment.com/api/v1/license/activate", content);
        var jsonStr = await response.ContentReadAsStringAsync();

        using var doc = JsonDocument.Parse(jsonStr);
        return doc.RootElement.GetProperty("success").GetBoolean();
    }
}

import requests

def activate_license(app_id: str, license_key: str, device_id: str) -> dict:
    url = "https://deliadevelopment.com/api/v1/license/activate"
    payload = {
        "appId": app_id,
        "license": license_key,
        "deviceId": device_id
    }
    res = requests.post(url, json=payload, timeout=10)
    return res.json()

# Example usage:
# result = activate_license("YOUR_APP_ID", "DELIA-XXXX-XXXX", "HWID_123")
# if result.get("success"):
#     print("License valid until:", result.get("expiresAt"))

# MASTER AI INTEGRATION PROMPT: DELIA DEVELOPMENT KEY SYSTEM

You are an AI developer assisting in integrating the Delia Development software licensing system into an existing application.

## CRITICAL INSTRUCTION FOR AI
⚠️ You MUST replace "<YOUR_APP_ID>" or "<YOUR_CLIENT_API_KEY>" with the user's actual App ID (e.g. `cmtdtjzrm0004q8gc2164jxp4`) or Client API Key (`del_sec_...`) from the Manage Apps dashboard! Never leave "YOUR_APP_ID_HERE" as a placeholder!

## ARCHITECTURE & ANTI-DECOMPILATION MANDATE
🔒 REQUIREMENT: You MUST build the client loader / key system in **Native C++ (x86/x64)**.
- DO NOT generate C#, .NET, or Java loaders. Managed bytecodes can be easily decompiled into full source code with decompilers like dnSpy, ILSpy, or dotPeek.
- Native C++ compiles directly to machine code, forcing any reverse-engineering attempt to rely on native debuggers (x64dbg / IDA Pro).

## COMPILE-TIME STRING ENCRYPTION & VALUE OBFUSCATION MANDATE
🛡️ ALL sensitive strings and network values MUST be encrypted at compile-time (e.g. using an inline XOR string encryption template `XOR_STR("...")` or compile-time string obfuscation):
- MUST encrypt API Host (`deliadevelopment.com`), API Path (`/api/v1/license/activate`), App ID (`<YOUR_APP_ID>`), user-agent strings, and JSON keys (`"appId"`, `"license"`, `"deviceId"`).
- NO plaintext URLs, hostnames, App IDs, or sensitive keys may appear in the compiled binary file (`strings` inspection MUST show NO readable plaintext endpoint values).

## API Endpoint
POST https://deliadevelopment.com/api/v1/license/activate

## Request Format (JSON):
{
  "appId": "<YOUR_APP_ID>",         // OR "apiKey": "<YOUR_CLIENT_API_KEY>"
  "license": "<USER_ENTERED_KEY>",
  "deviceId": "<HARDWARE_ID>"       // User's PC HWID
}

## Security & Verification Behavior:
1. Validates that the license exists and is not EXPIRED or DISABLED.
2. If UNUSED (first launch), it automatically binds the user's PC Hardware ID (deviceId) and logs their IP address.
3. If ALREADY ACTIVE, it verifies that the incoming deviceId matches the bound Hardware ID. If another PC tries to use the same key, it blocks access with DEVICE_MISMATCH.
4. Returns a cryptographic HMAC-SHA256 session token (`authSig`) signed with server secrets. The C++ loader MUST verify that `authSig` is present before granting access.

## Successful Response (JSON):
{
  "success": true,
  "status": "active",
  "expiresAt": "2026-12-31T23:59:59.000Z",
  "hwidBound": "HWID-12345",
  "ipLogged": "1.2.3.4",
  "authSig": "a4f891b2..."
}

## Error Response (JSON):
{
  "success": false,
  "code": "INVALID_LICENSE" | "LICENSE_EXPIRED" | "LICENSE_DISABLED" | "DEVICE_MISMATCH",
  "message": "Human readable error message"
}

Please implement a clean, secure native C++ authentication routine using compile-time string encryption for all URLs, App IDs, and JSON keys, verify the response against the endpoint, and prevent access if validation fails or HWID mismatches.