Docs / Licensing
A protected build can be bound to one machine, given a deadline, or both at once. Licensing is applied inside the artifact during the same pass that protects it, and it is metered like every other obfuscation.
A machine lock binds the finished build to one computer. The hardware fingerprint is captured at build time, hashed with PBKDF2-HMAC-SHA256, and used as the additional authenticated data for the AES-GCM encryption of the payload. The fingerprint is therefore part of the authentication of the ciphertext rather than a comparison made after the fact, which means a different machine cannot decrypt the build at all. There is no branch to patch and no check to skip, because the artifact cannot read its own bytecode without the machine it was authorised for.
Two fingerprint formats are accepted. Supply the value in whichever form your licence system issues, and it is used as given.
| Format | Shape | Example |
|---|---|---|
| Dynamic | 64 lowercase hexadecimal characters | 3f9c0a1b7d5e4c2f8a6b0d9e1c3f5a7b8d0e2c4f6a8b0d2e4f6a8c0e2d4f6a8b |
| Static | S- followed by four groups of four uppercase hexadecimal characters | S-4F2A-90BC-1E3D-77A0 |
Leave the machine lock empty for an unlocked build. A locked build is tied to the single fingerprint captured when it was built, so issue a fresh build for each machine you authorise rather than reusing one artifact.
A trial build carries a deadline inside the artifact. The build behaves normally until the window closes, then refuses to run. Windows are written as a number and a unit, from thirty minutes up to a year.
| Unit | Meaning | Example |
|---|---|---|
| m | Minutes | 30m |
| h | Hours | 12h |
| d | Days | 7d |
| w | Weeks | 1w |
| mo | Months | 1mo |
| y | Years | 1y |
Units can be concatenated into a compound window, so a licence of one week and two days is expressed as a single value rather than converted to hours by hand.
The window is sealed into the artifact itself rather than recorded beside it. Copying the build to another machine breaks the trial instead of extending it.
Moving the system clock backwards does not reopen a closed window. A rollback is treated as tampering and the build refuses to run.
Machine locking and a trial window are independent settings, and setting both on the same build is the usual shape for a delivered licence. The artifact then runs only on the authorised machine, and only until the deadline passes. Neither control weakens the other: the machine lock still gates decryption on every run, and the deadline still ends the build wherever it is running.
Both values live in the same settings object the rest of the pipeline reads, so a licensed job is submitted exactly like any other. Populate the machine lock and the trial window and send the job as usual. Leaving either one empty disables that control.
curl -X POST https://nyami.cc/api/obfuscate \
-H "X-API-Key: nyami_your_key_here" \
-F "file=@script.py" \
-F 'settings={"optimization":"1","python_version":"3.14","anti_debug":"none","hwid":"S-4F2A-90BC-1E3D-77A0","trial_time":"7d"}'import json
import requests
settings = {
"optimization": "1",
"python_version": "3.14",
"anti_debug": "none",
"hwid": "S-4F2A-90BC-1E3D-77A0",
"trial_time": "7d",
}
with open("script.py", "rb") as handle:
response = requests.post(
"https://nyami.cc/api/obfuscate",
headers={"X-API-Key": "nyami_your_key_here"},
files={"file": ("script.py", handle, "text/x-python")},
data={"settings": json.dumps(settings)},
timeout=120,
)
response.raise_for_status()
print(response.json()["jobId"])The settings object is documented in full on the settings page, and the submission flow is walked through in the quickstart.
Licensing is not a separate meter. Every obfuscation debits one credit from a finite balance, from the dashboard or the API alike, whether or not the build carries a machine lock or a trial window. Nothing is unlimited on any plan.
| Plan | Allowance | Notes |
|---|---|---|
| Pay as you go | 1 credit, no expiry | One obfuscation, no subscription. |
| Starter | 50 credits over 30 days | Dashboard access. |
| Starter API | 100 credits over 30 days | Adds external API keys. |
| Pro | 1000 credits over 30 days | Dashboard access and the priority queue. |
| Pro API | 500 credits over 30 days | External API keys. |
| Business | 1000 credits over 30 days | API only, built for teams and CI/CD. |
Refilling a bucket that is still funded adds bonus days, capped per bucket. Credits are consumed in the same transaction that creates the job, so a job that never runs does not leave a half charged account behind.
Because credits are shared between the dashboard and the API, a build protected from the dashboard and a build protected from a CI pipeline draw down the same balance. The dashboard and API pages cover the surfaces themselves; the ledger is one.
What happens when the build runs on the wrong machine? It does not run. The fingerprint is part of the authentication of the encrypted payload, so decryption fails on any machine other than the one the build was authorised for. There is no warning path and no bypass, because the artifact never reaches the point of executing code.
What happens when a trial expires? The build refuses to run. An expired deadline and a clock rolled backwards both end in the same place, so the artifact fails closed instead of continuing in some degraded mode.
Can a trial be reset by moving the clock? No. Clock rollback is detected, and moving the build to another machine breaks the trial rather than extending it. If a customer needs more time, issue a new build with a new window.