Documentation

Everything you need to protect a script and hand it out. The dashboard guides you through the same steps.

1. Lock your first script

Sign in, open New script, paste or upload your Lua/Luau source (up to 400 KB) and pick a preset. Saving re-locks the source: the server stores your original privately and keeps the protected payload separately. Your source never appears in any public URL.

2. Hand out loaders

A loader is a stable URL bound to a script. Users run one line:

loadstring(game:HttpGet("https://luawarden.pages.dev/api/loaders/<loader-id>"))()

Keyed scripts take the key on the URL (?key=YOUR-KEY). You can create up to 10 loaders per script, disable or revoke each one, and see its request count. Changing the underlying build does not change the loader URL.

3. Keys and licensing

Generate keys in the Keys tab or per script: set expiry in days, an HWID-reset budget, IP locking, and a note. A key activates on first use and binds to that executor's HWID. Reuse from another HWID fails with hwid_mismatch until you reset it.

4. Builds and publishing

The Obfuscator tab builds with the chosen preset and shows duration, sizes and a checksum. Publishing a build locks that payload into the loader chain as a new version; the build history keeps the last 50 builds as receipts.

5. The loader chain, in one picture

user's executor
  │  loadstring(game:HttpGet(loader_url))()
  ▼
GET /api/loaders/<id>        → bootstrap only (browser & raw-fetcher blocked)
  ▼
GET /api/load  (stage 1)     → key check for keyed scripts
  ▼
GET /api/load  (stage 2)     → authenticated payload fetch, HWID + nonce bound
  ▼
protected payload runs       → your source is never served in the clear

Loaders carry no secrets: they reference a project id, and every privileged decision happens server-side.

6. API

Every dashboard action has a JSON endpoint under /api/* and your per-account API key (Settings → API, regenerable). Sessions are signed HTTP-only cookies; the key is for scripted use. See the endpoint reference.

7. Migration

Older Discord-linked accounts use the one-time migration link on the sign-in page to move to email sign-in. Discord OAuth is migration-only and cannot be used for new sign-ins.