bsphp-gate API

Base: https://www.winstarpanel.com · Admin panel: https://www.winstarpanel.com/panel

Client

Method	Path	Auth	Notes
GET	/v1/ping	—	Health probe
POST	/v1/client/login	HMAC body	Canonical: card\|device\|software_id\|ts\|nonce (LuaSkin)
POST	/public/v1/client/package	package token	AuthTool DEVICE_ID compat · AES-ECB response
POST	/public/v1/client/check	token + AES body	AuthTool /check by device uid
POST	/public/v1/client/login	token + AES body	AuthTool /login (key + uid)

Login example (HMAC)

POST https://www.winstarpanel.com/v1/client/login
Content-Type: application/json

{"card":"LSK-....","device":"abc123","software_id":"luaskin","ts":1730000000000,"nonce":"n1","sig":"<hmac-sha256-hex>"}

Response codes: OK, INVALID_KEY, EXPIRED, REVOKED, LOCKED, DEVICE_LIMIT, WRONG_SOFTWARE, BAD_SIG, STALE_TS, MISSING_FIELDS

AuthTool client base URL

https://www.winstarpanel.com/public/v1/client
→ POST …/package  { "token": "<packageToken>" }
→ POST …/check    { "token", "data": "<AES-ECB-PKCS7 of {uid,clientOS,clientModel,clientOSVersion}>" }
→ POST …/login    { "token", "data": "<AES-ECB-PKCS7 of {uid,key,clientOS,…}>" }
HTTP 200 → { "data": "<encrypted payload>" } · errors → { "message": "…" }

Admin (Bearer token)

Roles: owner (BSPHP_ADMIN_SECRET), admin / readonly via BSPHP_STAFF_SECRETS JSON or KV staff:{sha256(token)}, agent / subagent via POST /v1/agent/login. Write ops need owner or admin; resellers use agent routes with role permissions.

Method	Path	Write
GET	/v1/admin/me	— · also agent/subagent
GET	/v1/admin/stats?group_id=	—
GET	/v1/admin/health	—
GET	/v1/admin/keys/list?limit=&group_id=	—
GET	/v1/admin/backup	—
GET	/v1/admin/groups/list	—
GET	/v1/admin/notifications/list	—
POST	/v1/admin/keys/create	yes · count up to 500 · optional key_prefix · optional package_id
POST	/v1/admin/packages/create	yes · AuthTool-style package token + AES generate
GET	/v1/admin/packages/list	— · package token / AES for clients
POST	/v1/admin/packages/update	yes · rename / disable / regenerate creds
POST	/v1/admin/keys/revoke	yes
POST	/v1/admin/keys/lock	yes · locked true\|false
POST	/v1/admin/keys/reset	yes · clear device binds
POST	/v1/admin/keys/lookup	—
POST	/v1/admin/keys/history	—
POST	/v1/admin/keys/bulk	yes · action revoke\|delete\|extend
POST	/v1/admin/keys/transfer	yes
POST	/v1/admin/groups/create	yes
POST	/v1/admin/groups/assign	yes
POST	/v1/admin/notifications/clear	yes
POST	/v1/admin/restore	yes · dry_run optional
POST	/v1/admin/agents/create	owner only
GET	/v1/admin/agents/list	owner only
POST	/v1/admin/agents/update	owner · balance, groups, key_prefix, disable

Agents & subagents

KV agent:{username}: role (agent|subagent), optional parent_username, pass_hash, balance, allowed_group_ids[], key_prefix, mint_index[], subagent_usernames[]. Subagents inherit parent group/prefix scope, balance 0 (no mint). Subagents cannot nest.

Agent: create/delete keys, lock, reset, check, history, create/manage subagents.
Subagent: lock, reset, check, history only (no create/delete keys, no adding agents).

Method	Path	Auth
POST	/v1/agent/login	username + password → Bearer (7d)
GET	/v1/agent/groups/list	agent\|subagent
POST	/v1/agent/keys/create	agent only
GET	/v1/agent/keys/list	agent\|subagent
POST	/v1/agent/keys/revoke	agent only
POST	/v1/agent/keys/lock	agent\|subagent
POST	/v1/agent/keys/reset	agent\|subagent
POST	/v1/agent/keys/lookup	agent\|subagent
POST	/v1/agent/keys/history	agent\|subagent
POST	/v1/agent/subagents/create	agent only
GET	/v1/agent/subagents/list	agent only
POST	/v1/agent/subagents/update	agent only

Owner: create agent

POST https://www.winstarpanel.com/v1/admin/agents/create
Authorization: Bearer <BSPHP_ADMIN_SECRET>

{"username":"shop1","password":"secret123","balance":100,"allowed_group_ids":["abc123"],"key_prefix":"IOSSTAR","note":"Tier-1"}

Agent: mint keys

POST https://www.winstarpanel.com/v1/agent/keys/create
Authorization: Bearer <agent session token>

{"software_id":"luaskin","days":30,"max_devices":1,"count":1,"note":"order-99"}
→ key like IOSSTARKJGGJJHG765FHHVFX when agent key_prefix is IOSSTAR (group_id optional)

Bulk example

POST https://www.winstarpanel.com/v1/admin/keys/bulk
Authorization: Bearer <secret>

{"action":"extend","keys":["LSK-..."],"add_days":30}
// or {"action":"revoke","filter":{"group_id":"abc","status":"active"}}

401 unauthorized · 403 forbidden (readonly) · 404 not found · 400 bad input