Test endpoint

A sandbox copy of the key check with its own messages, emulator and signature domain.

Keep in mind

Off until you switch it on: Turn it on in Connect Settings or with edit-soft and test_connect_enabled. While it is off the address answers 404.
Needs a secure secret: With signing on and no secure test secret, every call answers 503.
Own texts: The test_err_* messages and test_emulator_response are set apart from the main ones.
Always HMAC: Test tokens are always hmac-sha256, whatever the main endpoint uses.

Test a key

POST https://dev.mod.wtf/{soft_id}/test/connect

Same fields as the key check. Form-urlencoded only, Accept: application/json, body up to 4096 bytes.

Form fields

game string required

Game or product. Up to 32 characters.
user_key string required

License key. Up to 32 characters. Pattern ^[A-Za-z0-9:@_-]{1,32}$.
serial string required

Device identifier (HWID). Up to 255 characters. No commas, quotes or control characters.

POST /{soft_id}/test/connect HTTP/1.1
Host: dev.mod.wtf
Content-Type: application/x-www-form-urlencoded
Accept: application/json

game=pubg&user_key=XXXX-XXXX-XXXX-XXXX&serial=device-id

curl -sS -X POST 'https://dev.mod.wtf/{soft_id}/test/connect' \
  -H 'Accept: application/json' \
  --data-urlencode 'game=pubg' \
  --data-urlencode 'user_key=XXXX-XXXX-XXXX-XXXX' \
  --data-urlencode 'serial=device-id'

const response = await fetch("https://dev.mod.wtf/{soft_id}/test/connect", {
  method: "POST",
  headers: { Accept: "application/json" },
  body: new URLSearchParams({
      "game": "pubg",
      "user_key": "XXXX-XXXX-XXXX-XXXX",
      "serial": "device-id"
  }),
});

const result = await response.json();

$ch = curl_init('https://dev.mod.wtf/{soft_id}/test/connect');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Accept: application/json'],
    CURLOPT_POSTFIELDS => http_build_query([
        'game' => 'pubg',
        'user_key' => 'XXXX-XXXX-XXXX-XXXX',
        'serial' => 'device-id',
    ]),
]);

$result = json_decode(curl_exec($ch), true);

import requests

response = requests.post(
    "https://dev.mod.wtf/{soft_id}/test/connect",
    data={
        "game": "pubg",
        "user_key": "XXXX-XXXX-XXXX-XXXX",
        "serial": "device-id",
    },
    timeout=10,
)

result = response.json()

#include <curl/curl.h>
#include <string>

static size_t collect(char* data, size_t size, size_t count, void* out) {
    static_cast<std::string*>(out)->append(data, size * count);
    return size * count;
}

int main() {
    CURL* curl = curl_easy_init();
    std::string response;
    std::string body = "game=pubg&user_key=XXXX-XXXX-XXXX-XXXX&serial=device-id";

    curl_easy_setopt(curl, CURLOPT_URL, "https://dev.mod.wtf/{soft_id}/test/connect");
    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, body.c_str());
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, collect);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response);
    curl_easy_perform(curl);
    curl_easy_cleanup(curl);
}

{
    "status": true,
    "data": {
        "real": "modkey-connect-v2|test|{soft_id}|pubg|XXXX-XXXX-XXXX-XXXX|device-id",
        "token": "<SIGNATURE_HEX>",
        "modname": "",
        "mod_status": "",
        "credit": "",
        "ESP": "",
        "Item": "",
        "AIM": "",
        "SilentAim": "",
        "BulletTrack": "",
        "Floating": "",
        "Memory": "",
        "Setting": "",
        "EXP": "2026-11-05 13:24:57",
        "Enc": "List Of Games",
        "device": 1,
        "rng": 1793269497
    },
    "info": "powered by mdk panel",
    "domain": "https://dev.mod.wtf/"
}

{
    "status": false,
    "reason": "Key not found!"
}

{
    "status": false,
    "reason": "Request too large"
}

{
    "status": false,
    "reason": "Request limit exceeded. Try again in a minute. >MDK<"
}

An HTML 404 page, the same as for any unknown address.

{
    "status": false,
    "reason": "Test Connect is not securely configured."
}

Signature domain

Test tokens are signed over a source with a fixed prefix, so a test answer can never pass as a real one.

Test source and an example

modkey-connect-v2|test|{{soft_id}}|{{game}}|{{key}}|{{serial}}
modkey-connect-v2|test|{soft_id}|pubg|XXXX-XXXX-XXXX-XXXX|device-id

Token

hex(HMAC-SHA256(source, CONNECT_SECRET))

HTTP statuses

HTTP	When
200	Validation result, including normal license denials
404	Endpoint unavailable
413	Request body exceeds 4096 bytes
429	Request rate limit exceeded
500	Could not generate a response
503	Temporary server failure, or Test Connect is disabled because its configuration is insecure

#Keep in mind

#Test a key

Form fields

#Signature domain

#HTTP statuses

Keep in mind

Test a key

Signature domain

HTTP statuses