AnziLock

What AnziLock Is

AnziLock is one self-hosted service at license.ajdnikov-dev.com with several parts that share the same accounts and licences:

Bundles

One licence key can unlock several products. It verifies for each of them, grants each product's Discord roles and downloads, and shares one set of IP and server limits.

Getting Your Key

Keys look like ANZI-XXXXX-XXXXX-XXXXX-XXXXX. After you buy a plugin on BuiltByBit, BuiltByBit tells AnziLock about the purchase and an unclaimed licence is created for that plugin, tagged with your BuiltByBit username. You then claim it in one of three ways:

The claim is matched to the waiting licence by BuiltByBit username (case-insensitive). Staff approve it, or — when the purchase can be confirmed against BuiltByBit's purchase list — it may be approved automatically. Once approved, the key is posted in your ticket behind a spoiler, sent to you by DM, linked to your portal account, and your customer roles are granted.

If no purchase matches, staff may ask for proof of purchase before creating your licence. A rejected claim is DMed to you with the reason.

Already have a key?

Run /verify key:ANZI-… in the Discord, or use Link a key in the portal. That links an unowned key to your Discord account (creating your portal account if you never signed in) and grants your roles. A key that already belongs to someone else is refused.

Putting the Key in a Plugin

Paste the key into the plugin's config file and restart the server. The setting is named in each plugin's manual — for example licenseKey in AjdnikovPanel's config.properties. On success the console shows:

[AnziLock] License valid (lifetime) · licensed to steve
[AnziLock] Update available: 1.3.0 (you run 1.2.0)

The second line only appears when a newer version is published. A licence with an end date prints expires 2027-01-31 instead of lifetime.

On failure the plugin prints a block with the result code, a message, and the key with most of it masked, then applies the product's failure action:

[AnziLock] ================================================
[AnziLock] License check failed: IP_LIMIT_REACHED
[AnziLock] <the reason>
[AnziLock] Key: ANZI-XXXXX-…
[AnziLock] ================================================
[AnziLock] Disabling YourPlugin.

With an empty key the plugin stops with NO_KEY before contacting anyone.

How a Check Works

A plugin checks its key when it starts (verify) and then again on a heartbeat (by default every 10 minutes). Each check is one HTTPS request:

Plugin                                   AnziLock
  │  POST /api/v1/client/verify            │
  │  {key, product, hwid, nonce, …}  ───▶  │  blacklist → product → key → status → expiry
  │                                        │  → IP / server / seat limits → record usage
  │  ◀───  {payload, signature}            │  payload = {code, valid, action, heartbeat,
  │                                        │            grace, nonce, hwid, ts, …}
  │  check signature, nonce, hwid, time    │
  │  VALID   → cache the signed answer, schedule the next heartbeat
  │  invalid → run the failure action (DISABLE / SHUTDOWN / WARN)
  │  no reply → keep running on the cached answer for the grace period

AnziLock checks, in order: whether the IP or server is blacklisted, whether the product exists and is active, whether the key exists and belongs to that product (or a bundle that includes it), whether it is suspended or expired, and whether the IP, server and seat limits allow one more. The first check that fails decides the answer.

The answer is signed with AnziLock's private key. The plugin carries the matching public key, so it accepts only answers that really came from AnziLock, for this request, for this server, and no older than 15 minutes. See Security model.

On start-up the plugin tries up to 3 times with a timeout of a few seconds each, so a slow network delays start-up by seconds, not minutes.

Offline Grace & Failure Actions

When AnziLock can't be reached

Your server does not stop because the licence server has a bad minute. After every successful check the plugin stores the signed answer next to its data. If a later check cannot reach AnziLock, the plugin keeps running on that stored answer for the product's grace period (by default 1 hour) and logs how long is left:

[AnziLock] License server unreachable (…). Running on the last signed check for another 47 min.

When the grace period runs out without a successful check, the failure action runs. A server that has never verified successfully cannot run offline — the first start needs a connection.

Rate limits, replayed requests and malformed requests are not verdicts on your licence: the plugin keeps its previous state and tries again on the next heartbeat.

Failure actions

Each product chooses what happens when a licence is rejected. The choice travels inside the signed answer, so it cannot be changed on the way.

Limits & Resets

Every licence carries three limits. The defaults come from the product; staff can change them per licence.

Resetting IPs yourself

Moved hosts, or your host changed your IP? Clear the bound IPs with /reset-ips in the Discord or Reset IPs on the licence in the portal. Self-service resets are allowed per product and have a cooldown (24 hours by default). Staff can reset IPs without a cooldown, and reset servers (hardware IDs), from a ticket.

Moving a server to a new folder or machine changes its hardware ID. If that pushes you over the server limit, open a ticket.

Result Codes

The code is printed in the console when a check fails, and listed per request on your licence in the portal.

The Licence Portal

Open license.ajdnikov-dev.com and choose Continue with Discord. You see only your own licences.

Roles

Discord Commands

The AnziLock bot runs in the ajdnikov Discord. All replies are ephemeral: only you see them.

Roles

Each product can grant Discord roles. You hold a product's roles while you own at least one licence for it that is active, not expired and not suspended. Roles update the moment that changes, and are re-checked every 30 minutes.

Direct messages

AnziLock DMs you when a key is delivered (with the download link), a few days before a licence expires, when it expires, when it is suspended, and when a claim is rejected.

Tickets & Panels

Support panels in the Discord are messages with buttons. Each button opens a private ticket channel (visible to you, the bot and staff), opens an application form, starts a purchase claim, or links to a page. The Custom plugins panel asks five questions about the plugin you want and opens a ticket with your answers in it — see Custom Requests.

You can have one open ticket per kind of button, so an open support ticket does not block a plugin application. When a ticket is closed it is archived or removed from the Discord; the conversation is saved first, so staff can still read it.

Networks

The AjdnikovPanel dashboard is served by AnziLock, not by your machine. Your hub opens one outgoing WebSocket to AnziLock (the relay) and proves itself with its licence key and hardware ID. AnziLock answers with a welcome signed by the same key as licence answers, so a fake server cannot drive your hub. From then on AnziLock signs people in with Discord, decides who may open the network, and passes their requests down that socket.

• No port, password, address or tunnel on your side — only outgoing HTTPS (port 443).
• Every 15 seconds the hub reports players and server states for the network list. Nothing about individual players leaves the hub except while someone is looking at the dashboard.
• You can share a network with your staff as Viewer or Admin, and give AnziLock staff read-only support access for 1 hour to 7 days. Without a grant, staff see only whether your network is up, its players, servers and version.
• Every visit by someone other than the owner, every change, and every sharing change is written to the audit log.

Setup, sharing and the relay in detail: AjdnikovPanel manual → Licensing & Relay.

Phone App

The AnziLock Android app opens the portal and adds notifications. Turn them on inside the app under Account → Phone notifications and pick what you want to hear about:

Notifications arrive instantly by push, and the app also checks about every 15 minutes and whenever it is opened. You can pin up to 5 networks: each stays in the notification shade with its status, players and servers, and has an Unpin button.

Notifications are only stored for accounts with a phone switched on, and are deleted after 14 days. Switching the phone off in the app revokes its access; phones not heard from in 90 days are removed.

Security Model

The check itself

• Every answer, valid or not, is signed with Ed25519. The plugin embeds the public key and rejects anything unsigned or mis-signed.
• The plugin sends a fresh random nonce with every request. The answer must echo it, and AnziLock refuses a nonce it has seen in the last 10 minutes, so old answers cannot be replayed.
• The answer echoes the server's hardware ID, so an answer for one server cannot be reused on another.
• The answer carries a timestamp; the plugin rejects answers older than 15 minutes.
• The stored offline answer is the last signed valid answer, bound to the key and hardware ID, and honoured only for the grace period.
• The failure action is part of the signed answer, so it cannot be downgraded on the way.

The service

• Licence keys are stored encrypted (AES-256-GCM), looked up by a keyed hash. A database dump alone does not reveal keys.
• Portal sessions are random 256-bit tokens, stored hashed, in HttpOnly; Secure; SameSite=Lax cookies. Signing out and bans end them.
• Every state-changing portal request needs a CSRF header and a matching origin; every input is validated; strict security headers and a Content-Security-Policy are set.
• Rate limits per IP on every route, and 60 checks per minute per licence key.
• Blacklists for IPs and hardware IDs are checked before any licence logic.
• Every staff action — including revealing a key — is written to an audit log with who did it and from where.
• AnziLock runs as a non-root container behind a Cloudflare Tunnel, with no open inbound port.

What a Plugin Sends

Each check sends exactly this, and nothing about your players or worlds:

AnziLock also sees the public IP the request comes from, which is what the IP limit counts. Request logs are kept for a limited number of days and then pruned. What AnziLock stores, for how long, and how to have it deleted is set out in the Privacy Policy; for questions about your data, open a ticket.

Troubleshooting

Need more help?

Open a ticket in the Discord server or from Support in the portal.