Device reputation API

Ban the device, not the account.

Account and IP bans don't scale — the cheater is back in minutes on a new account, same PC. HWID-Guard weighs a server-side hardware fingerprint, catches VMs and emulators, and gives you one API call to keep banned devices out.

First check in five minutes. Seven SDKs, or a zero-code gateway.
POST /v1/check
# the same banned device, on a brand-new account
curl https://sigelis.cruxsacra.com.br/v1/check \
  -H "Authorization: Bearer hg_live_•••" \
  -d '{"identifiers":[{"type":"smbios_uuid","hash":"a1f…"}]}'

{
  "verdict": "BAN",
  "reason": "device banned — cheating",
  "vm_detected": false, "score": 92
}
● BAN Blocked before the login completes. Even inside a VM.
Built for indie game studios · OTServer & FiveM · launchers · anti-fraud teams
The problem

The banned player always comes back.

✕ Ban the account

New account, same hardware, five minutes later. Account bans have no cost of re-entry — so they don't stick.

✕ Ban the IP

A VPN costs nothing and changes in one click. IP bans punish shared connections and miss the actual abuser.

A small team can't run an anti-cheat department to fix this. You need a signal tied to the device — one that's easy to drop in.

How it works

Three steps between a login and a verdict.

01 · Collect

The client gathers signals

Your game, launcher, or app collects hardware identifiers through the SDK — hashed on the way out.

02 · Check

Your server asks

One request: POST /v1/check. The signals are weighed on our server, never trusted from the client.

03 · Decide

You get a verdict

ALLOW, BAN, or REVIEW. Banned once, the device stays out of every new account.

ALLOW

Clean device. Let it through. No friction for the players who did nothing wrong.

BAN

Matches your banlist. Blocked — and a ban keeps precedence even when the device is running inside a VM.

REVIEW

Enough signal to flag, not enough to block outright. The call stays yours, with the evidence attached.

Why it holds up

Hard to fool. Easy to trust.

Honest about what it is: a weighted, server-side signal — not a magic box. That's exactly why it holds.

Self-declaration never wins

The verdict is computed on your server — the client never votes on its own trust. Claiming "I'm native" or "I have a TPM" earns nothing; only cryptographic proof gets precedence, and a guess always cedes to real evidence. Patching the game changes nothing.

Weighted composite

No single signal decides. Someone who swapped a hard drive isn't banned by accident — a threshold of real hardware evidence is.

VM & emulator aware

Spinning up a virtual machine to reset hardware trips detection — a disposable device shouldn't count as a fresh, legitimate one.

Monitor mode

Run it observe-only first. See every verdict it would have made — in your logs — before you block a single player.

Adversarially reviewed

Our decision paths are attacked by an independent, different-model reviewer that tries to break them — and what it finds, we close. A guess and a proof are never treated the same, and we tell you which is which.

Integration

The easy part is on purpose.

The moat isn't the algorithm — it's that you're live this afternoon instead of building a fingerprint stack from scratch.

Seven SDKs, or none at all.

Drop in the SDK for your stack. Or put the gateway in front of your app as a reverse proxy and write no code at all.

.NETUnityC++TypeScriptPythonElectronFiveMGateway (zero-code)

Read the quickstart →

Program.cs — .NET
var guard = new HwidGuard("hg_live_•••");
var r = await guard.Check(HwidCollector.Collect());

if (!r.IsAllowed)
  BlockLogin(r.Reason); // BAN / REVIEW
Straight answers

The four questions every dev asks.

What about privacy and LGPD/GDPR?

Only hashes reach the server — never the raw identifier. Retention is configurable per tenant, and nothing unnecessary is stored. You decide what your client collects; we weigh what you send.

Won't it ban innocent players?

The composite needs several signals to reach a ban, so a player who changed one part won't trip it. REVIEW gives you a middle ground, and monitor mode lets you watch every verdict before you enforce anything.

Can't I just build this myself?

You can. Then you maintain the fingerprint weighting, the infrastructure, seven SDKs, and a banlist panel — instead of shipping your game. HWID-Guard is that whole stack, ready to call.

Will it slow my game or app down?

No — by design. This is not a runtime anti-cheat living inside your app: there's no resident process, no hooks, no kernel driver, no continuous scanning. The collector runs once at login — reads a handful of identifiers, hashes them locally, sends a few KB — and the heavy lifting (weighing, banlist, analysis) happens on our server, not on your player's machine. You set the API timeout, and fail-open is the default: if we're ever unreachable, your players still get in. The platform grows server-side; the client footprint stays one call.

Primeiros 10 · vagas reais

Founding design partners

Estou pegando os 10 primeiros servidores pra rodar junto. O acordo, inteiro e sem letra miúda:

Você recebe
  • Grátis em volume de Pro
  • Eu integro a primeira vez com você
  • Monitor mode — você não arrisca nada antes de bloquear
  • Voz no roadmap
Em troca
  • Um depoimento / logo, quando funcionar
  • Umas calls de feedback

É isso. Sem cartão, sem contrato, sem pegadinha. "Primeiros 10" é de verdade — é tudo que eu consigo integrar direito sozinho.

Quero ser design partner
Pricing

Start free. Pay when it's protecting you.

Early access — the first studios help shape the plans. Rough shape below; talk to us and we'll fit it to your volume.

Free
$0
Wire it up, run monitor mode, see it work.
  • 1 app · 10,000 checks / mo
  • All SDKs + the gateway
  • Panel, bans, audit log
Get your API key
Most teams
Pro
$49 / mo
Production volume and the operational tools.
  • 250,000 checks / mo · unlimited apps
  • Webhooks + SIEM export
  • IP allowlists, key controls
Start a pilot
Enterprise
Let's talk
Your team, your rules, your infrastructure.
  • SSO/SAML, roles & invites
  • SLA + dedicated deployment
  • On-prem / self-host option
Contact us
Get started

Stop ban-evasion this week.

Create an app, generate a key, run your first check in five minutes. Monitor mode means you risk nothing to see it work.

Get your API key Read how it works