Getting Started

This section walks through the minimum steps to get from a blank vendor account to a working app with real keys you can test.

1. Create your vendor account

1. Open the Phantom panel and register with your email.
2. Sign in using your credentials or vendor token.

2. Create your first app

Apps represent individual products or loaders.

POST /vendor/apps
Authorization: Bearer <vendor JWT>
{
  "name": "My Loader"
}

3. Generate some keys

Inside the vendor dashboard, open your app and click Generate Keys, or use the API:

POST /vendor/apps/{appId}/keys/create
Authorization: Bearer <vendor JWT>
{
  "count": 10
}

Creating Apps

Each app in Phantom tracks its own keys, sessions and audit log. If you sell multiple tools, give each one its own app.

Fields

• Name — friendly name shown in the vendor panel.
• Created at — timestamp for auditing.

API example

POST /vendor/apps
Authorization: Bearer <vendor JWT>
Content-Type: application/json

{
  "name": "Internal Test Loader"
}

Managing Keys

Keys are short strings like PH-ABCDEFGH.... Keys can be unused, active or banned.

Key lifecycle

1. Vendor generates keys for an app.
2. User redeems a key in your loader or panel.
3. Loader talks to Phantom and marks it active.
4. Vendor can extend, ban or delete the key at any time.

Create keys

POST /vendor/apps/{appId}/keys/create
{
  "count": 25
}

Ban / unban / delete

POST /vendor/keys/ban      { "key": "PH-..." }
POST /vendor/keys/unban    { "key": "PH-..." }
POST /vendor/keys/delete   { "key": "PH-..." }

Device Sessions

Sessions track when a key is actively being used from a particular IP / HWID combo. They’re useful for enforcing “one device at a time” rules and spotting shared keys.

Typical flow

1. Loader calls your /auth/check endpoint.
2. Backend validates the key with Phantom.
3. If valid, backend records a session for that key + HWID.

Discord Integration

Phantom can be paired with a Discord bot or server to restrict access to customers who own valid keys or specific roles.

Vendor Discord settings

GET  /vendor/discord/settings
POST /vendor/discord/settings
{
  "guildId": "123...",
  "roleId": "456...",
  "logChannelId": "789...",
  "allowCommands": true
}

Bot token login

Your bot can log into Phantom using the token panel, then attach the returned JWT to API calls.

Desktop Integrations

Desktop apps can talk to Phantom using plain HTTPS calls. Any language that can perform JSON requests will work.

// pseudo C#
var payload = new {
  appId = 1,
  key   = userKey,
  hwid  = myHardwareId
};

var json   = Json.Serialize(payload);
var result = await http.Post("https://your-backend/auth/check", json);

Game / Loader Integrations

Loaders and game tools often run before anything else. They’re a natural place to perform a key check.

Typical loader flow

1. Show a simple window or console asking for a key.
2. Send the key (plus app info + HWID) to your backend.
3. Backend calls Phantom’s API to validate.
4. If the response is ok, continue running; otherwise exit.

Unity-style pseudo example

// inside an async Unity method
var payload = new { appId = 1, key = userKey, hwid = hwidString };
// send JSON using UnityWebRequest, then check the status field
// in your backend's response

Web Integrations

Web dashboards can call Phantom from a backend API route while keeping vendor tokens off the client.

// example: Node.js backend route
app.post("/api/phantom/check", async (req, res) => {
  const { key, hwid } = req.body;

  // talk to Phantom from server-side
  // then proxy back a simple status to the browser
});

REST API

Phantom exposes JSON endpoints for vendor dashboards, bots and loaders. All protected routes require a Bearer token.

Auth

POST /login           // email + password
POST /auth/token-login

Vendor

GET  /vendor/apps
POST /vendor/apps
GET  /vendor/apps/{appId}/keys
POST /vendor/apps/{appId}/keys/create

Error Codes

Most responses from Phantom include a short error string when something goes wrong.

• invalid_credentials — email or password wrong.
• no_token — missing Authorization header.
• invalid_token — JWT is expired or malformed.
• not_found — key or app doesn’t exist.
• server_error — unexpected exception.

FAQ

Can I rotate my vendor token?

Yes. Use the /vendor/token/regenerate endpoint.

Does Phantom care what my app does?

No. Phantom just answers “is this key valid?” and optionally tracks sessions. Your project keeps full control.