Getting started

Migrating from Luarmor

What to rename, what stays the same, and what works differently.

On this page

What stays the same

  • Players still set script_key = "..." before the loadstring.
  • The key check library has the same shape: script_id, check_key, load_script, purge_cache and the same status codes (KEY_VALID, KEY_HWID_LOCKED, …).
  • Runtime variables and the init macro keep their names — only the prefix changes.

Rename table

LuarmorSantiAuth
LRM_INIT_SCRIPT(function() ... end)SA_INIT_SCRIPT(function() ... end)
LRM_IsUserPremiumSA_IsUserPremium
LRM_LinkedDiscordIDSA_LinkedDiscordID
LRM_ScriptNameSA_ScriptName
LRM_TotalExecutionsSA_TotalExecutions
LRM_SecondsLeftSA_SecondsLeft
LRM_UserNoteSA_UserNote
LRM_ScriptVersionSA_ScriptVersion
https://sdkapi-public.luarmor.net/library.luahttps://api.santiauth.com/api/loader/v4/library.lua
ProjectService
Ad System (Rewards)Key page & providers
Sellix / Shoppy serialsSelling keys — keys are generated on each sale
/resethwid/key reset-hwid or the Reset HWID button on the Discord bot panel
Webhook protectionDiscord webhooks from your script

A quick way to convert a script:

text
Find:     LRM_
Replace:  SA_

In practice, most scripts only change in a few lines:

main.lualua
LRM_INIT_SCRIPT(function()SA_INIT_SCRIPT(function()    -- your key UIend) if LRM_IsUserPremium thenif SA_IsUserPremium then    unlockPremium()end

Step by step

  1. Create a service and a provider for your key flow.
  2. Replace LRM_ with SA_ in your source and update the library URL if you use it.
  3. Upload the script in Obfuscation — the whitelist is embedded automatically.
  4. Replace the Luarmor loader you give players with the SantiAuth loadstring.
  5. Point your store at a store webhook and post a bot panel in your Discord.

What works differently

  • The whitelist is inside your file. There is no separate loader that downloads your source — see Built-in whitelist.
  • Sessions are live. A heartbeat re-checks the key every 20 seconds; SA_SessionValid turns false when the server rejects the session (or after 3 unreachable heartbeats in a row), so you can stop loops on a revoked key.
  • Two extra variables: SA_SessionId and SA_SessionValid.
  • One extra client status code: NETWORK_ERROR when the API can't be reached (see Status codes).
  • No LPH_NO_VIRTUALIZE. Only SA_INIT_SCRIPT is a SantiAuth macro. Choose the obfuscator and its options per script in Obfuscation.

Keeping your players' keys

Export your keys from Luarmor and import them so paying players keep the key they already have. Import is a CSV upload through the API (not the dashboard yet) — one key per line after a header row:

text
key,name,expires_at
JnX84BqRL2c7Qm1ZK9pTw4sVa0Fh3Yx1,alice,2026-12-31T00:00:00Z
Pw7Ld2mQx9Vb3Nc6Rt1Ys8Ku4Hg5Jf0a,bob,
ColumnMeaning
keyThe key value, kept as is.
nameOptional label.
expires_atOptional ISO date; empty means lifetime.
bash
curl -X POST https://api.santiauth.com/api/keys/import \
  -H "x-api-key: <your-api-key>" \
  -F file=@keys.csv \
  -F provider_id=<provider-id> \
  -F service_id=<service-id>

Create the API key in Dashboard → API keys; find the provider ID in Service → Providers.