HidoHido for providers
Integration guide · Last updated November 8, 2026
Hido works with V2Board, Xboard and XiaoV2Board panels as they are. This page is for providers who want to limit devices with Hido's device ID (HWID), or who run a modified panel.
1. Get a provider code
Email [email protected] with:
- Your service name and the code you would like (lowercase letters and digits, for example
abcvpn). - Your panel's API address, plus any backup addresses customers can use when one is blocked.
- Your subscription domain, if it differs from the panel.
- Your purchase link and support channel, shown in the app under Account → Details.
- For a modified panel, the options in the table below.
You can change domains at any time. Tell us and existing installs follow without an app update or a new sign-in.
| Option | Use it when | Default |
|---|---|---|
api_path | Your API is not under /api/v1, for example /api/v3. Hido uses this path for sign-in, the account and the subscription link it receives. | /api/v1 |
payload = header | Your panel takes every call as a GET, with the JSON body base64url-encoded in an X-Payload header. | POST with a JSON body |
hido_client | You want to recognize Hido on API calls: it then sends the Hido User-Agent, X-Device and the device headers on every call, sign-in included. | Off |
2. What Hido sends
On every subscription download
These headers always go out, with the same names Happ and Remnawave use, so a panel that already limits devices for those apps works with Hido unchanged. A panel without a device limit simply ignores them.
| Header | Example |
|---|---|
x-hwid | 3f2a9c0d5e7b41a8c6d2e9f0a1b3c4d5 |
x-device-os | iOS, Android |
x-ver-os | 18.5 |
x-device-model | iPhone 16 |
x-device-locale | en |
The download's User-Agent looks like Hido/v2.0.5 clash.meta mihomo clash-verge Platform/ios. Serve the Clash Meta (mihomo) format, as you already do for clash.meta clients.
On panel API calls (with hido_client)
| Header | Example |
|---|---|
User-Agent | Hido/v2.0.5 (iOS; 18.5) |
X-Device | iPhone 16: a readable name for your device list |
x-hwid | The same device ID as above, with the other device headers |
Authorization | The auth_data your login returned |
GET /api/v1/user/getSubscribe HTTP/1.1
Authorization: Bearer …
User-Agent: Hido/v2.0.5 (Android; 15)
X-Device: Samsung SM-S928B
x-hwid: 3f2a9c0d5e7b41a8c6d2e9f0a1b3c4d5
x-device-os: Android
x-ver-os: 15
x-device-model: Samsung SM-S928B
x-device-locale: viAbout the device ID
- 32 lowercase hexadecimal characters, so it fits Remnawave's HWID rules.
- A one-way hash of the phone's own ID (Android ID, or a Keychain item on iPhone and iPad). The raw ID never leaves the phone, and the value does not match what other apps send.
- It stays the same when the customer reinstalls Hido, and it differs from one device to the next.
- Customers can see and copy it in Settings, so support can find them in your device list.
3. Where to count devices
Subscription links are often shared and fetched by other tools, so we recommend counting devices on the account calls and keying each device by x-hwid, named with X-Device:
POST {api_path}/passport/auth/loginand/passport/auth/registerGET {api_path}/user/getSubscribe
For an account signed in with a provider code, Hido calls getSubscribe right after sign-in, before every subscription update (manual or automatic), when the app opens and every 30 minutes while it stays open. So the device is counted even if your subscription route does not count devices.
Customers who only paste a subscription link (no sign-in) send the device headers on the download alone. To limit them too, count on your subscription route as well.
4. Answers Hido understands
Hido shows your message word for word, so write it in your customer's language and include what they should do next.
| Your panel answers | Hido does |
|---|---|
403 with {"code": "device_limit_exceeded", "message": "…"} | Shows the message. A signed-in account is signed out on this device and its configuration removed. A pasted link stays, but is not updated. |
429 with {"code": "device_cooldown", "message": "…", "data": {"retry_after_minutes": 42}} | Shows the message, keeps the account, and does not retry on its own. Put the wait time in the message. |
401, or 403 without a code, on a call with Authorization | Treats the device as signed out: the account leaves the device and the customer signs in again. Use this for a device you removed from the account. |
Subscription response header x-hwid-max-devices-reached: true or x-hwid-limit: true | Shows its own device-limit message, as with Remnawave. |
5. Checklist before going live
- Sign in from Hido: the device appears in your panel with the name from
X-Device. - Reinstall Hido and sign in again: it is still the same device, not a new one.
- Sign in on one device more than the plan allows: that device gets your 403 message and is signed out.
- Remove a device in your panel, then tap Update in Hido on it: the account leaves that device until the customer signs in again.
Questions or a test build for your panel: [email protected].