For plugin authors
Dungeon Helper only loads plugins it has authorized. This page covers what a plugin author needs to do to
ship one. Plugins are built against the VoK.Sdk NuGet package and draw their windows with ImGui.
How authorization works
Authorization is an entitlement: a small document signed by Dungeon Helper’s issuer key, which is built
into every copy of Dungeon Helper. An entitlement names your public key, your plugin’s [PluginId], its
install name, and a tier:
| Tier | For |
|---|---|
| community | A published plugin. Bound to one plugin id and one install name, which must be unique. |
| personal | Your own development machine. Covers anything signed with your key, on one machine only, and expires. |
| official | Plugins published by Dungeon Helper itself. |
Your key signs everything else, and Dungeon Helper checks that it’s the key the entitlement names.
1. Make a key
A self-signed certificate is fine: Dungeon Helper checks which key signed your files, not a certificate chain.
openssl genrsa -out plugin_name.key 2048
openssl req -x509 -new -key plugin_name.key -days 365 -out plugin_name.crt
openssl pkcs12 -export -out plugin_name.pfx -inkey plugin_name.key -in plugin_name.crt
openssl rsa -in plugin_name.key -pubout -out public.pem
Keep the .key and .pfx private. Only public.pem is ever shared.
2. Request an entitlement
Ask in Discord. You’ll need your public.pem, your plugin’s [PluginId]
GUID, and the install name you’d like. For a personal entitlement you’ll also need your machine
identity: in the Dungeon Helper app, go to Maintenance → Machine Identity and press Copy. It’s a
one-way hash; your Windows machine ID itself never leaves your PC.
A personal entitlement is installed as machine.entitlement in %LocalAppData%\DungeonHelperData, and the
Machine Identity card then shows whether it’s active.
3. Sign what you ship
Every plugin bundle contains:
- the plugin DLL, Authenticode-signed with your key (signtool);
<Name>.pem, your public key;<Name>.entitlementand its.sig;<Name>.manifestand its.sig: the list of every file in the bundle, signed with your key. Regenerate it after every build.
Your assembly must declare a [PluginId] that matches the entitlement.
Common mistakes: shipping a stale .pem, shipping a generic public.pem instead of <Name>.pem, signing
with a password-protected .pfx, and committing a personal entitlement to a public repository.
4. Publish updates
For players to get updates in the app, publish a plugin.metadata feed with a detached plugin.metadata.sig
signed by your key. The feed’s sequence number must only ever increase: Dungeon Helper refuses a feed older
than one it has already seen.
If something is refused
Dungeon Helper shows the reason in game ([NOT AUTHORIZED] under the plugin) and in the app. Common ones:
- “Entitlement was not signed by a Dungeon Helper issuer key”: the entitlement is missing or edited.
- “Signed by a key that is not the entitled author’s”: the DLL or manifest was signed with a different key.
- “This file’s contents do not match its signature”: the DLL changed after it was signed.
- “Entitlement is for a different plugin”: the
[PluginId]doesn’t match. - “Personal entitlement was issued for another machine” or “Personal entitlement expired on …”.
- “Built against VoK.Sdk … ; this Dungeon Helper hosts …”: rebuild against a compatible SDK.