Roblox Luau · API v5 · self-hosted

Nobody runs your script without asking first.

KunAuth sits between your Luau payload and the executor. It checks the license, binds the hardware, mints a session that dies in five minutes, and writes down every attempt — before a single byte of your source moves.

Open the consoleSee the integration
Every key
shown once
Every session
dies in 5 min
Device slots
per license
Every attempt
written down

POST /api/v5/auth/verify

gate
  1. 01License keyrecognised, or not
  2. 02Statusactive · banned · disabled
  3. 03Expirystill in date
  4. 04Devicethe machine it was bound to
  5. 05Slotwithin the device limit
  6. 06Sessionissued for five minutes

Payload released

GET /api/v5/files/payload · X-Session-Token

200

A license key alone never returns the script. Only a live session bound to the verified device does.

// protection

Four mechanisms, each doing one job

Nothing is decided on the player's machine. Every check that releases your script runs on the server, where nobody can reach in and change it.

License system

Every key is random and impossible to guess, and leaves out O/0 and I/1 so your customers cannot mistype it. You see the key once — when you create it — and never again.

  • One or 100 at a time
  • Expiry, note and slot count per key
  • Ban, disable or delete instantly
Your license keyshown once
↓ scrambled one way, cannot be undone
••••••••••••••••••••••••all the database keeps
Last 4 characters onlyall a log ever shows

HWID protection

The first device to use a key claims a slot. Others are refused until you reset it.

  • Device IDs never kept in readable form
  • You set how many devices each key allows
  • Reset a customer's device in one click

2 / 5 devices bound

Secure sessions

Every verification mints a fresh token tied to that license and that device. There is no fixed token to lift.

  • Expires five minutes after it is issued
  • Kept alive while the script runs, never reused
  • Dies the moment you ban the key
5:00

then it expires
a new one every run
never reused

Script delivery

The protected source lives behind one endpoint that accepts a session token and nothing else — not the key, not an admin cookie, not a query string you can share.

  • Your source is never served from a public link
  • Version each script and roll out updates
  • Switch a script off and every loader stops
session token→license + device + expiry re-checked→payload
license key→always refused

// integrate

One line to ship it. Five endpoints behind it.

Drop the loader into your executor and it handles the prompt, the fingerprint, the session and the heartbeat. Or call the API yourself — it is plain JSON.

main.lua
-- Optional: skip the in-game prompt by setting the key firstgetgenv().KUN_KEY = "KUN-AUTH-XXXX-XXXX" loadstring(game:HttpGet(    "https://your-domain.com/api/v5/files/kun.lua"))()
lua6 lines·no server secret ever ships to the client

Every refusal is one of these — never a generic 500

  • INVALID_KEY
  • KEY_EXPIRED
  • KEY_BANNED
  • KEY_DISABLED
  • HWID_MISMATCH
  • DEVICE_LIMIT
  • SESSION_EXPIRED
  • SCRIPT_DISABLED
  • RATE_LIMITED
  • INVALID_REQUEST
  • SERVER_ERROR

// topology

Where the trust boundary actually sits

Only node 01 runs on someone else's machine. Everything that can say yes lives on your server, behind your own database.

  1. 01

    Executor

    untrusted client

  2. 02

    Edge gateway

    rate limit · validation

  3. 03

    License registry

    unreadable form

  4. 04

    Device ledger

    devices · slots

  5. 05

    Session vault

    expires in 5 min

  6. 06

    Payload vault

    your script source

Audit streamevery edge above writes here — actor, IP, masked identifiers, outcome

// signals

Numbers we can actually show you

Counted live from the gateway itself — not a marketing figure someone typed in.

Authorized executions
4,140all time

One per script handed out to a verified device — every other attempt was turned away.

F
S
S
M
T
W
T

last 7 days

Active licenses
1

issued and not expired

Protected scripts
1

served only behind a session

Bound devices
0

hardware slots in use

Live sessions
29

tokens valid right now

// pricing

Pick the ceiling you need

Every plan is the same gateway with the same checks. The only thing that moves is how many scripts, keys and devices you are allowed to run through it.

01

Starter

One script, one seller.

$9/mo

scripts
1
active keys
100
slots / key
1
  • HWID binding with one-click reset
  • 5-minute session tokens + heartbeat
  • Full audit log of every attempt
  • Web console for keys, devices and logs
Start with Starter
most picked
02

Pro

A hub with a real customer list.

$29/mo

scripts
10
active keys
2,000
slots / key
5
  • Everything in Starter
  • Bulk key generation, 100 per batch
  • Expiry dates, ban and unban
  • Device ledger with last-seen and IP
  • Email support within 24 hours
Choose Pro
03

Studio

A team shipping several products.

$79/mo

scripts
Uncapped
active keys
Uncapped
slots / key
100
  • Everything in Pro
  • Unlimited scripts and keys
  • Multiple console accounts
  • Priority support and onboarding
Get Studio
in every planRuns on your own server and databaseKeys stored in a form nobody can read backNo per-seat fee, no revenue shareCancel any time

No plan claims unbreakable DRM — code that runs inside someone else's executor never can be. What you buy is revocation, device limits and an audit trail, all enforced on your server.