Key check library

Check a key without kicking, then load the protected script — for custom key UIs and your own loaders.

On this page

When to use it
Usage
API
The data field
Caching
Download grant
Status codes

When to use it

The built-in whitelist kicks on a bad key. When you want to handle the error yourself — show a message, open the key page, retry — use the key check library, either inside SA_INIT_SCRIPT or in your own loader.

Usage

lua

local lib = loadstring(game:HttpGet("https://api.santiauth.com/api/loader/v4/library.lua"))()
lib.script_id = "<script-id>" -- set this first (inside SA_INIT_SCRIPT it is already set)

local status = lib.check_key(script_key)

if status.code == "KEY_VALID" then
    lib.load_script() -- downloads and runs the protected script
elseif status.code == "KEY_HWID_LOCKED" then
    warn("Reset your HWID in our Discord")
else
    warn(status.message)
end

API

Member	What it does
`lib.script_id = "..."`	Your script ID. Required for `load_script()` and ownership checks. Set automatically inside SA_INIT_SCRIPT.
`lib.service = "..."`	Your service slug. Required for `get_key_url()`. Set automatically inside SA_INIT_SCRIPT.
`lib.check_key(key)`	Returns `{ code, message, data }`. Never kicks. On `KEY_VALID` sets `getgenv().script_key`.
`lib.validate_key(key)`	Shorthand for `check_key(key).code == "KEY_VALID"`.
`lib.load_script()`	Downloads and runs the protected script, with a local cache.
`lib.purge_cache()`	Deletes the cached script. Returns `true` on success.
`lib.get_key_url()`	Your key page link, e.g. `https://santiauth.com/a/my-hub`.
`lib.get_key()`	The key currently in use.
`lib.get_key_info()`	Details about the current key.

The `data` field

On a successful check, status.data contains:

Field	Meaning
`auth_expire`	Unix timestamp when the key expires; `0` for lifetime keys.
`note`	The key's tier: `"Premium"` or `"Standard"`.
`total_executions`	How many times the key has loaded the script.

Caching

load_script() caches the protected file in workspace/santiauth/. On the next run it asks the server whether the file changed and reuses the cache if not. It also falls back to the cache when the API is unreachable, rate-limited (429) or failing (5xx). A refused key never falls back to the cache.

Download grant

The protected file is served only with a short-lived download grant (2 minutes) that the server returns for a valid check_key(). load_script() handles it for you:

it reuses the grant from your last check_key() while it is fresh, and calls check_key() again otherwise;
if the server answers GRANT_REQUIRED (the grant expired in between), it checks the key once more and retries once;
if the key is no longer valid, it throws SantiAuth: <code>: <message> instead of running anything.

Load the library from https://api.santiauth.com/api/loader/v4/library.lua so you always get the current version. An older copy pasted into your script still works (the server answers it with a stub that checks the key itself), but checks the key twice and gets no caching.

Status codes

See Status codes for everything check_key can return.