{"title":"Extra server validation (license check)","summary":"Asphalt already checks license on Play. You can also make your .exe ask Asphalt on startup whether this PC is licensed — no server of your own.","steps":["Upload a compiled .exe (prefer compiled over raw .ahk).","Keep Private — launcher only for paid tools.","Copy your Runtime client id from the distributor dashboard listing.","On startup: POST /api/runtime/check with { clientId, hwid, nonce }. Exit if ok is false.","Verify the RSA-SHA256 signature (or at least pin https://asphaltlauncher.com) so a hosts-file fake server cannot return ok:true.","Buyers press Play once in Asphalt Launcher — that binds their PC. After that the check can pass on that same machine."],"integrity":{"alg":"RSA-SHA256","ttlSec":120,"publicKeySpkiB64":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqDHDUJM0lKOugWqxySvhutwRkDmA9LKV8/ZYB7meDxd77Hr7Sl5zUQAMYHF5NK3ruZGm5U/lEMEGe5qmLJ4OBAeb5QyX45v90j8Nj+RWh3KEbAbAsskmbxpeFI+1wlmTCrJ7RNqQrzWI1GGI2OGCAP+d+FiIpzdPw130Eye7hFpgl/e5TKWZH+A0IclCszvgsoJqjPTumq8Gld9x3v/R/z9yyqMgJ4JrL1KGCVIAgeni1a1CRCWwCIi2RhfL0ErAdbjN7HU6uQcLYETRGe8erGZG03etdb2dE7/WN0LUt8VCoBZ6GT2+aZSRONkNJZlj2IcDiqaZ6AiiQWX66sVplQIDAQAB","note":"Only Asphalt’s private key can mint a valid ok:true. Embed publicKeySpkiB64 (or fetch GET /api/runtime/keys once at build time). Still not unbreakable DRM — a cracker can patch out the whole check."},"endpoint":{"method":"POST","path":"/api/runtime/check","body":{"clientId":"asc_…","hwid":"device-id","nonce":"optional-random"},"success":{"ok":true,"code":"LICENSED","payload":"v1|1|clientId|hwid|productId|exp|nonce","sig":"base64 RSA-SHA256 of payload"},"denyCodes":["UNKNOWN_CLIENT","NO_LICENSE","INACTIVE","NOT_RELEASED","BAD_CLIENT","BAD_HWID"]},"hostHint":"asphaltlauncher.com"}