Changelog
Version history for the Obsidian platform, SDKs, and dashboard. Entries are ordered newest first.
v1.1
Released alongside a quality-of-life fix for the dashboard's Users tab.
Changes
| Area | Change |
|---|---|
| SDK (all languages) | register() now automatically calls login() after a successful registration. |
| Dashboard | The last_login timestamp populates immediately after a user registers, so newly-created accounts no longer appear as "never signed in". |
| Behavior | No breaking changes. The registration response body is unchanged; the extra login happens transparently and the client is left in the same authenticated state it would be in after a manual login. |
Why
Before v1.1, a freshly-registered user had a created_at timestamp but a null last_login, which made the Users tab show new sign-ups as inactive. The dashboard operator had to wait for the user to open the client again before the row showed any activity. Now last_login is stamped as part of registration, and the Users tab reflects reality on the first refresh.
Migration
Nothing to do. Existing integrations continue to work. If you were calling login() immediately after register() yourself, you can remove that second call, but leaving it in place is safe.
v1.0
Initial public release.
Highlights
- Runtime license activation for Windows applications written in C#, C++, or Python.
- HMAC-SHA256 request signing on every client call. See Request Signing.
- Ed25519 response signing with an SPKI pin baked into each SDK. See Security Model.
- Hardware fingerprint locking with dashboard reset workflow. See HWID Lock.
- Rotating-token heartbeats for the C++ SDK, with a code-hash channel for injection detection. See Heartbeat.
- Full dashboard: applications, license keys, end users, team, resellers, blocked IPs, auth logs. See Applications.
- VMProtect-hardened SDK builds. The Python and C++ artifacts ship with virtualization applied to the auth-critical routines.
SDKs shipped in v1.0
| SDK | Runtime | Distribution |
|---|---|---|
| C# | .NET Framework 4.7.2+ | Single-file .cs drop-in plus csproj snippet. |
| C++ | MSVC x64 / x86 | Header + static/dynamic library, VMProtect applied. |
| Python | CPython 3.12, win_amd64 only | Wheel with compiled extension, VMProtect applied. |
Runtime protection
Every SDK downloaded from the dashboard is built on demand and injected with:
- The application's public API key and secret.
- The Ed25519 SPKI pin for the response-signature check.
- A per-build integrity hash used by the heartbeat channel.
The injection happens server-side when you press Download in the SDK Integration tab. Rotating your app secret invalidates every previously-downloaded SDK build and forces a fresh download.
Known limitations at 1.0
- Windows only. No macOS or Linux SDK. See the FAQ for the reasoning.
- No offline grace period. The client requires a reachable API for every
login()and every heartbeat. - Heartbeats are exposed by the C++ SDK only. The C# and Python SDKs authenticate but do not run the rotating-token loop.