LUAWARDEN · API
Developer API
Everything the dashboard does is available over plain JSON, authenticated with your API key.
Authentication
Send your key as a header on every request: Authorization: Bearer lwk_…. Your API key lives in the dashboard and behaves like a password; regenerate it there at any time.
Endpoints
| Endpoint | Method | What it does |
|---|---|---|
| /api/load | GET | Loader endpoint. Passes project, key and hwid; returns the protected script or rejects the key. |
| /api/scripts | POST | Create a script: source, preset, engine and options. Returns the script record and first key. |
| /api/scripts/[id] | GET / PATCH / DELETE | Read, update (re-obfuscates on source change) or remove a script. |
| /api/me | GET | Current account, usage counts and API key. |
| /api/me/regen-key | POST | Rotate your API key. The old one stops working immediately. |
| /api/login | POST | Email and password, or API key only. Returns a signed session token. |
Loading a script from Luau
local res = game:HttpGet("https://luawarden.pages.dev/api/load?project=PROJECT_ID&key="..key.."&hwid="..hwid)
local body = game:HttpGet(res.load_url) -- key-gated, one-time URL returned on a valid load
loadstring(body)()
Keys are HWID-bound on first use. A wrong or expired key returns a plain rejection line, never the payload.
Server-side security
Protection is layered, not one trick:
- Secrets stay server-side. Nothing privileged ships in the Lua file; anything a client runs can be inspected.
- Keys are validated here, not in the script: expiry, kill switch, HWID and IP locks, rate limits, and per-request replay protection on the loader URL.
- Builds run a bytecode VM with control-flow transformation, encrypted constants and identifier renaming. No layer claims to be unbreakable.
- Integrity is enforced by the VM itself: instruction-stream checksums re-verified at run time, failing closed if bytes are altered.
- The loader uses HTTPS, validates every response before it executes, and every load is logged.
For the server side of your own game (RemoteEvents, cooldowns, validation), download the reference template: ability-security.lua — drop it in ServerScriptService and adapt it.