L3 SimGuard Documentation
SimGuard Error Codes
L3 SimGuard is the external, file-system DRM for non-WASM MSFS content (scenery and other package files that are not compiled into an aircraft WASM module). The SimGuard runtime watches the Community folder and decrypts protected files on the fly. To do so it requests a per-package decryption key from the L3 license server using the customer's activation key plus a stable device id.
When a key request fails, the server returns one of the codes below. They are written to the SimGuard log at %ProgramData%\L3SimGuard\logs\simguard-YYYYMMDD.log. Ask the customer for the latest log; the raw server code is recorded there.
Common operational symptoms
- Pink / magenta textures or missing scenery almost always mean MSFS opened a protected file but did not receive decrypted bytes: SimGuard is not running, the sim was not detected, the filter driver is missing, or a key request failed (see the codes below). Check that
L3SimGuard.exeis running and inspect the log.- "Device limit reached": a Windows reinstall, new user account, or new hardware each consumes a device slot. Reset the activation under the "Activation Keys" section to free the bound devices.
Per-Package Errors
Returned inside the response items[] array. A single content package failed to obtain its key; other packages in the same request can still succeed. The Activation tab row for that package reflects the failure.
| Code | Type | HTTP | Message | Likely cause | Resolution |
|---|---|---|---|---|---|
AUTH_002 | MISSING_CREDENTIALS | 401 | Authentication failed | Request item is missing the product key, encrypted payload, or ephemeral key. | Client/build problem. Update SimGuard to the latest version and reinstall. |
AUTH_003 | INVALID_API_KEY | 401 | Invalid or incorrect key | The product key embedded in the package is unknown to the server. | Usually a corrupt or outdated package build. Re-download the product. |
AUTH_004 | INACTIVE_API_KEY | 401 | Please update this product | This product version has been deactivated server-side. | Update to the current product release. If it persists, escalate to L3. |
AUTH_005 | MALFORMED_PAYLOAD | 401 | Authentication failed | The encrypted payload could not be decrypted/parsed, or required fields (activation_key / device_id / challenge) were absent. | Client/build problem. Update SimGuard and reinstall. |
SIMGUARD_001 | SIMGUARD_NOT_ENABLED | 404 | L3SimGuard not enabled for this project version | SimGuard protection is not switched on for this project version (no key material configured). | Server configuration. Escalate to L3 to enable SimGuard for the product version. |
AUTHZ_001 | KEY_NOT_FOUND | 403 | Invalid or incorrect key | No activation key matched for this customer/product. | Wrong or missing activation key. Re-enter the correct key on the Activation tab (mind whitespace). |
AUTHZ_002 | KEY_INACTIVE | 403 | Key is inactive | The activation key exists but has been disabled. | Check order/refund status. Escalate if the key should be active. |
AUTHZ_003 | KEY_EXPIRED | 403 | Key has expired | A time-limited license has passed its expiry date. | Renew or repurchase the license. |
AUTHZ_004 | USER_BLOCKED | 403 | Access denied | The activation or device has been blocked. | Policy/abuse decision. Escalate to L3. |
SIMGUARD_002 | DEVICE_LIMIT_REACHED | 403 | Activation already bound to the maximum number of devices | The activation key is bound to more machines than its device limit allows. | Reset the activation under the "Activation Keys" section, which frees the bound devices. |
SRV_002 | DATABASE_ERROR | 503 | Service temporarily unavailable | A server-side database operation (device binding) failed. | Transient. Retry shortly. Escalate if persistent. |
SRV_001 | INTERNAL_ERROR | 500 | Internal server error | An unexpected server-side fault occurred while issuing the key. | Transient. Retry shortly. Escalate if persistent. |
Request-Level Errors
Returned as a single top-level { code, message } object – the whole request was rejected before any package was processed. These are transport, signature, or envelope failures rather than a problem with one customer's license.
| Code | Type | HTTP | Message | Likely cause | Resolution |
|---|---|---|---|---|---|
AUTH_001 | INVALID_USER_AGENT | 401 | Authentication failed | The request did not carry the expected SimGuard User-Agent. | Client/build problem. Update SimGuard to the latest version. |
AUTH_006 | INVALID_PUBLISHABLE_KEY | 401 | Authentication failed | The Supabase gateway key sent with the request is missing or wrong. | Build/config problem. Reinstall the current SimGuard release. |
AUTH_010 | INVALID_HMAC | 401 | Authentication failed | The request signature is missing, malformed, or does not match. | Client/build problem. Update SimGuard and reinstall. |
AUTH_011 | STALE_TIMESTAMP | 401 | Request timestamp out of range. Check system clock. | The request timestamp is too far from server time. | Fix the PC clock (enable automatic date/time) and retry. |
AUTH_012 | REPLAY_DETECTED | 401 | Authentication failed | A request id / nonce was reused (replay protection tripped). | Transient. Retry. If persistent, update SimGuard. |
AUTH_005 | MALFORMED_PAYLOAD | 401 | Authentication failed | The request body could not be read/parsed or the items array was empty or too large. | Client/build problem. Update SimGuard and reinstall. |
SRV_001 | INTERNAL_ERROR | 500 | Internal server error | An unexpected server-side fault occurred. | Transient. Retry shortly. Escalate if persistent. |
SRV_002 | DATABASE_ERROR | 503 | Service temporarily unavailable | A server-side database operation failed. | Transient. Retry shortly. Escalate if persistent. |
Tip: If license calls fail on a new machine with a network/timeout error rather than one of the codes above, the customer's firewall, VPN, or antivirus web-protection is blocking outbound HTTPS to the license server. Activating once on an unrestricted network lets the offline key cache cover the configured offline window.