Protect Your Node.js
Source Like a Pro

# Linux / macOS
$ curl -fsSL https://hash.boltopen.com/install.sh | sh
✔ bolt-hash@2.3.0 + bolt-hash-premium@2.3.0 installed → /usr/local/bin/bhp

# Windows (PowerShell — run as Admin)
$ irm https://hash.boltopen.com/install.ps1 | iex
✔ bolt-hash@2.3.0 + bolt-hash-premium@2.3.0 installed → C:\Program Files\BoltHash\bhp.exe

$ bhp config --license BH-XXXX-XXXX-XXXX-XXXX  # <-- use your Primary Key
✔ License key saved to ~/.bhp/config.json

$ cd my-node-app
$ bhp protect             # or: bolt-hash (legacy)
✔ 47 files protected → protected_output/
✔ __bolt_manifest.json created (Ed25519 signed)

$ cd protected_output
$ bhp start
  ✔ License verified — MyApp · professional plan
  ✔ Source signature OK (Ed25519)
  ✔ Anti-cheat OK — 47 files clean
  ⚡ Heartbeat every 60s · Kill timer: OFF
  → next start   [auto-detected]

# Protect Express app
$ cd my-express-app
$ bhp protect --src ./src --out ./dist-protected
✔ 23 files protected

$ cd dist-protected && bhp start
  ✔ Start: node server.js [package.json → main]

# Or set explicit start command in dashboard:
  start_command = "node server.js --port 8080"

# Option A: Use tsx (recommended)
$ npm install tsx
$ bhp protect --src ./src --out ./protected
$ cd protected && bhp start
  ✔ Start: tsx src/index.ts  [auto-detected via tsx dep]

# Option B: Compile first, run JS
$ tsc && bhp protect --src ./dist --out ./protected
$ cd protected && bhp start
  ✔ Start: node dist/index.js  [auto-detected]

$ next build
$ bhp protect --src ./ --out ./protected --exclude "node_modules,.next"
$ cd protected && npm install --production
$ bhp start
  ✔ License verified · Start: next start [auto-detected via next dep]

# Custom port — set in dashboard:
  start_command = "next start -p 4000"

# 1. Build the React frontend
$ npm run build            # → dist/

# 2. Protect your Node/Express API server (NOT the React dist)
$ bhp config --license BH-XXXX-XXXX-XXXX-XXXX   # your Primary Key
$ bhp protect --src ./server --out ./protected-server

# 3. Run protected API + serve React dist
$ cd protected-server && bhp start
  ✔ License verified · Start: node index.js [auto-detected]
  ✔ Serving React static from ../dist

$ react-scripts build        # → build/
$ bhp protect --src ./api --out ./protected-api --exclude "node_modules,build"
$ cd protected-api && bhp start
  ✔ Start: node server.js [auto-detected]

# Build Nuxt/Nitro SSR output
$ nuxt build                 # → .output/server/
$ bhp config --license BH-XXXX-XXXX-XXXX-XXXX
$ bhp protect --src ./.output/server --out ./protected-server
$ cd protected-server && bhp start
  ✔ License verified · Start: node index.mjs [auto-detected via nitropack]

$ npm run build                   # → dist/ (frontend only)
$ bhp protect --src ./backend --out ./protected-backend
$ cd protected-backend && bhp start
  ✔ Start: node app.js [auto-detected]

$ npm run build:ssr               # → dist/<app>/server/
$ bhp config --license BH-XXXX-XXXX-XXXX-XXXX
$ bhp protect --src ./dist/my-app/server --out ./protected-server --exclude "browser"
$ cd protected-server && bhp start
  ✔ License verified · Start: node server.mjs [auto-detected via @angular/ssr]

$ nx build api                     # → dist/apps/api/
$ bhp protect --src ./dist/apps/api --out ./protected-api
$ cd protected-api && bhp start
  ✔ Start: node main.js [auto-detected via @nestjs/core]

$ npm run build       # tsc → dist/
$ bhp protect --src ./dist --out ./protected-dist
$ cd protected-dist && bhp start
  ✔ Start: node dist/main.js  [auto-detected via @nestjs/core]

# List projects
GET  /api/projects

# List license keys for a project
GET  /api/licenses?projectId=<id>

# Generate a license key
POST /api/licenses/generate
{ "projectId": "...", "label": "Client #1", "expiresAt": "2026-01-01" }

# Verify license (called by bhp start / heartbeat)
POST /api/verify/license
{ "licenseKey": "BH-...", "deviceId": "...", "ip": "..." }

# API key management
GET  /api/auth/api-keys
POST /api/auth/api-keys
DELETE /api/auth/api-keys/:id