Ship the script. Own the keys.
A multi-tenant key system for Roblox/Luau executors. HWID-locked keys, Discord verification, signed delivery and per-script telemetry — instead of a spreadsheet and a ticket queue.
- Keys issued in seconds
- HWID + Discord binding
- Every delivery logged
Executions today
1,284
Active keys
312
Failures
4
| Key | Type | HWID | Uses |
|---|---|---|---|
VIP tier VIP-••••-••••-8HJCD | HWID | Locked | 1,284 |
Trial week K7M2Q-••••-••••-8HJCD | HWID | Locked | 312 |
Reseller batch RSL-••••-••••-9XTRB | Agnostic | Unbound | 96 |
How it works
Three steps, then it runs itself.
The console owns the lifecycle: upload, issue, observe. The Discord bot exposes the same operations to your team without sharing a login.
- 01POST /api/scripts
Upload the script
Drop a .lua or .luau file, choose the protection profile and get a reproducible obfuscation seed.
- 02POST /api/keys
Issue keys
Generate 1–100 keys at once, scope them to every script or a selected set, set expiry and cooldowns.
- 03GET /api/logs
Watch deliveries
Every execution, reset and failure lands in the log with the script, key prefix and HWID you need.
Everything in the box
Built for the parts that get abused.
HWID locking
Bind a key to the first device that uses it. Resets are owner-driven, rate-limited and cooldown-gated per key.
Discord identity
Require a linked Discord account per key. Link, unlink and audit the binding from the console or the bot.
Signed delivery
The loader hands out a short-lived, single-use token. The double-check bootstrap verifies it before your code runs.
Obfuscation pipeline
Upload .lua/.luau, obfuscate with a reproducible seed, re-run per version and see engine, seed and byte size.
Per-script telemetry
Deliveries, verifies, failures and unique keys per day, plus the keys actually being executed.
Abuse controls
Per-IP and per-key rate limits, expiry, execution ceilings, revoke and bulk delete — all audited.
Security model
Assume the client is hostile.
Keys travel through Discord DMs and executor callbacks, so the server trusts nothing it receives. Every check happens server-side, in order, with the reason recorded.
- Keys are stored hashed with an out-of-band pepper — a database dump does not yield working keys.
- Delivery tokens are HMAC-signed, bound to key + script + HWID and expire in seconds.
- Every route re-checks the caller's role server-side; the UI only hides what the API refuses.
- Failed lookups answer with a generic Luau error, so a probe cannot tell why it failed.
Start with one script and ten keys.
No card, no call. Sign in with Discord or email and issue your first batch.