Keys & players

Key page & providers

Your public key link, the key flows (providers) players pass, and how to protect them.

On this page

Your key link
Providers
Security options
Anti-bypass
Theme
Free days (keyless)
Public API

Your key link

Every service gets a public key page:

https://santiauth.com/a/<your-slug>

The slug is the Page link in Settings → General → Profile. In Lua, lib.get_key_url() returns the same link once lib.service = "<your-slug>" is set (inside SA_INIT_SCRIPT it is set for you). The page lists your service's providers; players pick one, pass its steps and receive a key.

Who can use it (same section) is either Everyone or Premium only.

Providers

A provider is one key flow. You can have several — for example a short key behind one step and a longer one behind more steps. Create them in Providers (sidebar → Access).

Setting	What it controls
Name	Shown on the key page.
Key flow	The ordered steps (checkpoints) players complete, up to 10. Each step is one of your revenues.
Key lifetime	Minutes, hours or days (presets from 1 hour to 30 days, up to 365 days).
Key usage policy	Standard — valid for the lifetime after it's issued. One-time — works for a single check, and expires after the lifetime if unused. First use — the countdown starts when the key is first checked.

Keys from a provider are always Standard keys. Premium keys come from manual creation, giveaways or store webhooks.

The order of providers on the key page is set by dragging them in Providers (owner and admins only). A provider card shows flows started, checkpoints passed and keys generated; View analytics (last 7, 14, 30 or 90 days, as your plan allows) adds the step funnel (where visitors leave, the biggest drop-off marked), completion per day (click a day for its hours, countries and executors; vs previous outlines the period before for ranges up to 30 days), countries — with keys ÷ flows per country once enough keys have a known country, as a list or on a map — referrers and executors. Click a step to open that revenue's analytics in the same window. Copy to another service duplicates a provider. Deleting a provider keeps keys it already issued.

Steps are backed by ad networks — see Ad networks & revenue for the 11 supported networks and how to connect each one.

Security options

In Settings → General:

Discord → Require joining my server — players sign in with Discord and must be a member of your server to continue. Use the SantiAuth bot (nothing to set up) or your own Discord app and bot. The Discord ID is linked to the key and shows up as SA_LinkedDiscordID.
Cloudflare Turnstile → Check visitors are human — a human check before the first step, using your own Cloudflare site key and secret key.

Anti-bypass

Every checkpoint completion is verified before a key is issued: step order, timing, referer and the ad network's own confirmation. Tune it in two places:

Settings → Protection
- Abuse limits — for every visitor: keys per day and minimum time per step; per device (browser): Keys per device and Devices per network (several browsers on one IP is normal for a family, many looks like a farm — over the limit means no key today, never a ban); per Discord account: keys per day, minimum account age, Discord accounts per network and networks per Discord account. Where visitors come back from sets the referer check: Relaxed (only known bypass sites are blocked), Balanced or Strict (unknown sources are rejected).
- Visitor filters — Block VPNs, Block Tor and Ask to turn off ad blockers.
- Borderline visitors — for flows that look suspicious but are not proven: Do nothing (only log), Extra step (the last step has to be done again) or Short key (the key lasts a quarter as long).
- Security log — what the protection saw on your key page, newest first: bans, refused steps, silent penalties and checks that are only watched for now (watch only). Filter by signal, outcome or one visitor (IP, Discord ID or device); click a visitor to see only their events.
Tampered or replayed links, bypass sites, decoy links and bots get an automatic 24-hour ban. VPN users — including Cloudflare WARP and iCloud Private Relay — are not treated as datacenter traffic.
Revenue → Edit settings on a Linkvertise, Work.ink, LootLabs or Cuty.io revenue — the Anti-Bypass API switch with presets against BYPASS.VIP, BYPASS.CITY and TRW-API, userscript detection, a honeypot completion and optional blocks for VPNs, ad blockers and incognito. Details in Ad networks & revenue.

Theme

Theme (sidebar → Customize) is a visual editor for your public key page: colours, texts of every step, a live preview per device and step, and undo/redo. No code needed.

Free days (keyless)

Want to go free for a weekend? Settings → General → Free days opens the service on the selected weekdays (UTC): the key page skips its steps and tells players no key is needed. With Run without a key on, the script's loader also runs without script_key on those days — see Keys → Free days.

Public API

The key page reads its configuration from a public, read-only endpoint (no session required):

http

GET https://api.santiauth.com/api/get-key/<your-slug>