Docs

SantiAuth Docs

Protect a Roblox script with a key system, hand out keys through a monetized key page, and automate it all with the API.

What your players executelua
script_key = "PASTE-YOUR-KEY-HERE"
loadstring(game:HttpGet("https://api.santiauth.com/api/loader/v4/script/<script-id>"))()

Start here

QuickstartCreate a service, upload your script and hand out the first key.Coming from LuarmorSame script_key and check_key. Swap LRM_ for SA_ and the loader URL.Automate with the APIIssue keys from your store or CI with a scoped API key.

Browse by topic

Introduction

What SantiAuth does

SantiAuth sits between your players and your script. You upload the script once, and every copy a player runs checks its key against our servers before a single line of your code executes.

  • Built-in whitelist — the whitelist is embedded into your script before obfuscation, so the protected file refuses to run without a valid key.
  • Keys — Standard or Premium, lifetime or timed, one-time or reusable, HWID-locked by default. Bulk actions, compensation, giveaways and sharing alerts.
  • Key page — a public page at santiauth.com/a/<your-slug> where players earn a key through checkpoints from 13 ad networks — Linkvertise, Work.ink, LootLabs and more — with anti-bypass built in.
  • Selling & Discord — keys delivered automatically from your store, a Robux shop, and a Discord bot panel where players get keys and reset their HWID themselves.
  • Runtime variables — your script can read SA_IsUserPremium, SA_SecondsLeft and friends.
  • Analytics — executions, executors, countries and revenue, live.

How the pieces fit

PieceWhereWhat it is
ServiceDashboardYour script hub. Owns keys, providers, the key page and settings.
ProviderDashboard → Service → ProvidersA key flow: checkpoints to pass and the rules of the key it issues.
RevenueDashboard → Service → RevenueYour ad-network accounts, used as steps of a provider.
ObfuscationDashboard → Service → ObfuscationYour uploaded scripts (obfuscated with the whitelist embedded) and loaders that route games to them.
Key pagesantiauth.com/a/<slug>Where players get keys. Themed per service.
Loaderapi.santiauth.com/api/loader/v4/script/<id>What players execute: checks the key, then downloads the protected file.

The player's journey

  1. 1

    Player → Key page

    Passes the checkpoints

  2. 2

    Key page → Player

    Issues a key

  3. 3

    Player → Executor

    Sets script_key, runs your loadstring

  4. 4

    Executor → SantiAuth API

    Validates the key, binds the HWID

  5. 5

    SantiAuth API → Executor

    Signed session and your protected script

  6. 6

    Executor

    Runs your code with SA_* variables

  7. 7

    Executor → SantiAuth API

    Heartbeat: still valid?

  1. The player opens your key link and passes the checkpoints.
  2. They get a key and set it in their executor: script_key = "...".
  3. They run your loadstring. The whitelist validates the key, binds the HWID and opens a signed session.
  4. Your code runs with SA_* variables filled in. A heartbeat keeps checking that the key has not been revoked or expired.

Hosts

HostUsed for
https://santiauth.comDashboard, docs, key pages (/a/<slug>) and giveaways (/g/<slug>).
https://api.santiauth.comAPI, loader, key check library and store webhooks.
EndpointWhat it returns
GET /api/loader/v4/script/<script-id>Your protected, obfuscated script — only with a download grant from a valid key check (X-SA-Grant header or ?g=). Without one: a small stub that runs that check itself.
GET /api/loader/v4/library.luaThe Key check library.
GET /api/get-key/<slug>Public key page configuration.

Where to next

QuickstartNew here? From an empty dashboard to a protected script.Key check libraryA custom key UI inside the game, with SA_INIT_SCRIPT.Key page & providersTune checkpoints, ad networks and anti-bypass.Selling keysDeliver keys from your store, then post the Discord bot panel.