Help

FAQ & troubleshooting

Answers to the questions players and script owners ask most — kicks, HWID locks, stale scripts and failing checkpoints.

On this page

The script kicks with "No key found"
load_script() fails with "GRANT_REQUIRED"
A player's key says "HWID locked"
I updated my script but players still get the old version
Checkpoints on the key page don't complete
Which obfuscators are supported?
Is my source code sent to players?
Can I use http:// loaders?
Where can I get help?

The script kicks with "No key found"

No script_key was set before the loadstring ran. The key must be set above the loadstring, in the same execution:

lua

script_key = "PASTE-YOUR-KEY-HERE"
loadstring(game:HttpGet("https://api.santiauth.com/api/loader/v4/script/<script-id>"))()

If you show your own key UI in SA_INIT_SCRIPT, make sure it blocks until a key is set — otherwise the whitelist starts before the player typed anything.

`load_script()` fails with "GRANT_REQUIRED"

The protected file is only served with a 2-minute download grant from a valid key check, and the key check library gets one for you, re-checking the key once if it expired. Getting this error means the server refused even the fresh grant: usually the player's clock or network is interfering (a proxy rewriting requests). Run the script again; if it persists, contact support with the time it happened.

A player's key says "HWID locked"

The key is bound to another device (a new PC, a reinstall or a different executor that reports another HWID). Reset it:

the player presses Reset HWID on your Discord bot panel, runs /key reset-hwid, or uses the self-service page santiauth.com/key (if you enabled it), or
you reset it from the key's menu in Keys.

If the same key keeps jumping between devices, it is probably being shared — check Keys → Sharing alerts, then disable the key or ban the holder (see Disabling and bans).

I updated my script but players still get the old version

Open the script in Obfuscation, choose Edit & re-run and paste the new source. The loader URL stays the same, and the key check library notices the change on the next run. Two things to know:

Re-obfuscate rebuilds a script with the latest SantiAuth client — use it after we announce a client update, not for your own changes.
A player stuck on a broken cached copy can run lib.purge_cache() once.

Checkpoints on the key page don't complete

Too fast. Each checkpoint has a minimum time; skipping ahead is treated as a bypass.
Bypass tools and userscripts. Completions through bypass sites or extensions are rejected by anti-bypass.
VPN, Tor, ad blocker or incognito. Allowed by default, but blocked if you turned on Block VPNs, Block Tor or Ask to turn off ad blockers in Settings → Protection → Visitor filters, or the matching options of a revenue's Anti-Bypass API.
Different browser or network halfway. Finish the whole flow in one browser.
The revenue was disconnected. Disconnecting a revenue removes it from every provider flow that used it — check the provider's steps.

Which obfuscators are supported?

Pick one per script in Obfuscation: the built-in SantiAuth engine (Medium or Strong preset, no API key needed), Luraph, wYnfuscate and IronBrew1. Each engine's options are in the upload form. Files up to 10 MB. Details: Obfuscation & loaders.