API Reference

The complete FlareKey API reference covers generated v2 runtime delivery, Script Library delivery, runtime logging, and dashboard management for your own workspace.

About these examples

Values in examples are placeholders that show the request shape, not fixed credentials or IDs.

Runtime API

Use these public-facing endpoints from a generated v2 loader or trusted runtime client. The customer license starts a session; signed clearance, an exact-build ticket, and signed download metadata authorize one protected delivery. This section is for generated-loader v2, not Script Library; custom-loader requests use the separate libdl_ and exec_ flow documented in Script Library.

Start with license verification. Keep the same service ID, device ID, script ID, session-bound protocol headers, and session token for the whole attempt.
After verification, send the returned session token as a bearer token. Request a single-use ticket immediately before running the protected source and download it once.
Treat errors as machine-readable outcomes. Back off on rate_limited, re-verify on session_expired, and request a new ticket on ticket_used or ticket_expired.

Route	Endpoint	Use it for
Verify license	`POST /v1/licenses/verify`	Create a runtime session
Resume device	`POST /v1/licenses/remember`	Resume a remembered device
Check session	`POST /v1/sessions/check`	Confirm a session is active
Create ticket	`POST /v1/scripts/:scriptId/ticket`	Authorize one protected download
Download script	`GET /v1/scripts/download`	Fetch protected source
Runtime telemetry (preauth-tamper)	`POST /v1/runtime/preauth-tamper`	Report pre-auth tamper
Runtime telemetry (preauth-failure)	`POST /v1/runtime/preauth-failure`	Report failed preflight
Runtime telemetry (failure)	`POST /v1/runtime/failure`	Report a runtime guard failure
Runtime telemetry (tamper)	`POST /v1/runtime/tamper`	Report authenticated tamper
Loader execution report	`POST /v1/runtime/loader-execution`	Record an automatic generated-loader start
Custom runtime log	`POST /v1/runtime/log`	Record a session-authenticated custom event
Runtime SDK source	`GET /v1/sdk/runtime.lua`	Fetch the public Lua SDK
Script telemetry	`POST /v1/scripts/:scriptId/tamper`	Report script tamper
Runtime probe	`POST /v1/runtime/echo`	Run the runtime echo probe
Clearance	`POST /v1/runtime/clearance`	Obtain runtime clearance
Runtime library	`GET /v1/lib/:serviceId`	Fetch the FlareKey UI library

Verify license

Endpoint: POST /v1/licenses/verify

Purpose: Create a runtime session

Send x-service-id, x-flare-session-bound, x-flare-protocol: 2, licenseKey, deviceId, and scriptId. Store the signed challenge and sessionToken; do not expect source.

HTTP request

http

POST /v1/licenses/verify
Content-Type: application/json
x-service-id: svc_xxx
x-flare-session-bound: rsa-sha256-v1
x-flare-protocol: 2

JSON body

json

{
  "licenseKey": "FLARE-XXXX-XXXX-XXXX-XXXX",
  "deviceId": "device_123",
  "fingerprint": "optional_fingerprint",
  "scriptId": "scr_xxx",
  "metadata": {
    "executor": "example",
    "loaderVersion": "1.0.0"
  }
}

JSON response

json

{
  "ok": true,
  "status": "active",
  "sessionToken": "api_sess_xxx",
  "expiresIn": 600,
  "license": { "id": "lic_xxx", "serviceId": "svc_xxx", "scriptId": "scr_xxx", "deviceBound": true }
}

Resume device

Endpoint: POST /v1/licenses/remember

Purpose: Resume a remembered device

Send the opaque remember token and current device identity. Fall back to verify if it is revoked or expired.

Request

http

POST /v1/licenses/remember
Authorization: Bearer api_sess_xxx
x-service-id: <value>
Content-Type: application/json

Current protocol v2 does not require x-runtime-key. That header is retained only for legacy protocol-1 compatibility and must not be added to a new generated loader.

Request body

json

{
  "serviceId": "string",
  "scriptId": "string",
  "rememberToken": "string"
}

Error codes: remember_resumed, blacklisted

Check session

Endpoint: POST /v1/sessions/check

Purpose: Confirm a session is active

Send Authorization: Bearer api_sess_xxx before another protected action.

Request

http

POST /v1/sessions/check

Response

json

{
  "ok": true,
  "serviceId": "string",
  "scriptId": "string",
  "licenseId": "string",
  "expiresAt": "string"
}

Error codes: invalid_session

Create ticket

Endpoint: POST /v1/scripts/:scriptId/ticket

Purpose: Authorize one protected download

Call immediately before download. The ticket is short-lived, script-bound, and single-use.

HTTP request

http

POST /v1/scripts/scr_xxx/ticket
Authorization: Bearer api_sess_xxx
Content-Type: application/json

JSON body

json

{ "reason": "load_protected_source" }

JSON response

json

{
  "ok": true,
  "protocolVersion": 2,
  "ticket": "ticket_xxx",
  "buildId": "bld_xxx",
  "artifactSha256": "64-lowercase-hex",
  "downloadUrl": "/v1/scripts/download",
  "expiresIn": 60
}

Download script

Endpoint: GET /v1/scripts/download

Purpose: Fetch protected source

Send the ticket in x-flare-ticket exactly once. The response is signed and identifies the frozen build and payload hash.

HTTP request

http

GET /v1/scripts/download
x-flare-ticket: ticket_xxx

Runtime telemetry (preauth-tamper)

Endpoint: POST /v1/runtime/preauth-tamper

Purpose: Report pre-auth tamper

Send the runtime signal when a preflight check detects tampering.

Request

http

POST /v1/runtime/preauth-tamper

Runtime telemetry (preauth-failure)

Endpoint: POST /v1/runtime/preauth-failure

Purpose: Report failed preflight

Send the failure context selected by the runtime preflight response.

Request

http

POST /v1/runtime/preauth-failure

Error codes: invalid_runtime_failure

Runtime telemetry (failure)

Endpoint: POST /v1/runtime/failure

Purpose: Report a runtime guard failure

Send the authenticated session and failure reason before stopping.

Request

http

POST /v1/runtime/failure

Error codes: runtime_fail_closed, invalid_session, invalid_binding, wrong_script, missing_nonce, invalid_runtime_failure, invalid_script, invalid_license

Runtime telemetry (tamper)

Endpoint: POST /v1/runtime/tamper

Purpose: Report authenticated tamper

Send the session-bound tamper event; never expose management credentials.

Request

http

POST /v1/runtime/tamper

Error codes: invalid_session, invalid_binding, wrong_script, missing_nonce, invalid_script, invalid_license, invalid_tamper_report, tamper_detected

Script telemetry

Endpoint: POST /v1/scripts/:scriptId/tamper

Purpose: Report script tamper

Send the authenticated session and script-specific signal.

Request

http

POST /v1/scripts/:scriptId/tamper

Response

json

{
  "ok": true,
  "blacklisted": "string",
  "expiresIn": 0
}

Error codes: invalid_session, license_not_found

Runtime probe

Endpoint: POST /v1/runtime/echo

Purpose: Run the runtime echo probe

Use only with the session and challenge fields supplied by the runtime flow.

Request

http

POST /v1/runtime/echo

Error codes: echo, invalid_session

Clearance

Endpoint: POST /v1/runtime/clearance

Purpose: Obtain runtime clearance

Send the authenticated preflight transcript; the server decides whether it is valid.

Request

http

POST /v1/runtime/clearance

Error codes: invalid_session, invalid_script, service_archived, script_disabled, wrong_script, loader_unavailable, preflight_protocol_failed, tamper_detected

Runtime library

Endpoint: GET /v1/lib/:serviceId

Purpose: Fetch the FlareKey UI library

Use the service ID and runtime flow. Never put dashboard API keys in a loader.

Request

http

GET /v1/lib/:serviceId

Query parameters

http

?scriptId=<value>

For the generated-loader beacon, custom SDK setup, payload limits, and dashboard behavior, see Runtime Logging.

Loader execution report

Endpoint: POST /v1/runtime/loader-execution

Purpose: Record an automatic start beacon from a generated loader

Generated loaders send this report automatically. It uses a short-lived, one-use canary issued with the loader response; fetching the loader alone does not count as an execution. The report is best-effort and does not block the loader if telemetry cannot be sent. A recorded start is not proof that the protected script completed.

Custom loaders should use the authenticated Custom runtime log endpoint for their own events instead of trying to construct this beacon.

Custom runtime log

Endpoint: POST /v1/runtime/log

Purpose: Save a custom runtime event for an active licensed session

The request requires Authorization: Bearer <sessionToken>. The session, service, script, and active license must match. The public Runtime SDK builds this request and applies client-side field limits.

JSON body

json

{
  "serviceId": "svc_xxx",
  "scriptId": "scr_xxx",
  "eventName": "round_started",
  "message": "Round started",
  "context": {
    "robloxUsername": "Player",
    "placeId": "123456789"
  },
  "fields": {
    "mode": "ranked",
    "round": 3
  }
}

The server allowlists context fields and accepts up to 12 scalar custom fields, with bounded names and values. Some credential-like field names are rejected, but message and field contents are not a secret scanner; never include credentials, raw HWIDs, source, or payloads in custom text. The endpoint responds with { "ok": true, "logged": true } when accepted. These records are telemetry only and do not authorize access or count as loader executions.

Error codes: invalid_session, wrong_service, wrong_script, service_disabled, script_disabled, invalid_license

Runtime SDK source

Endpoint: GET /v1/sdk/runtime.lua

Purpose: Download the public FlareKey Runtime SDK source

The SDK is public Lua source and contains no service or customer secret. It posts custom runtime events to /v1/runtime/log; pass an active FlareKey session token when constructing it. See Runtime Logging for a usage example and security notes.

Dashboard API

Use the universal API key from Settings for private workspace actions. Send it as Authorization: Bearer fk_live_xxx. API-key requests do not need browser x-flare-action or CSRF headers; rotating the key itself still requires a signed-in browser session.

Generate or regenerate the universal key from Settings → Universal API key. The raw key is shown once; if it is lost, regenerate it. Treat it like a password and never place it in a loader or customer-facing script.
Use the key for service creation/deletion, script creation, key management, dashboard reads, and obfuscation. Every action is still scoped to the authenticated workspace and owner/member permissions.
GET requests return workspace data. POST, PATCH, and DELETE requests perform management changes; send JSON bodies where the action table says a body is required.
The browser UI continues to use its signed session and CSRF protection. The universal API key is for private integrations and server-side automation.

Route	Endpoint	Use it for
Identity	`GET /api/dashboard/me`	Read identity and preferences
Account	`GET /api/dashboard/account`	Read account and plan
Update username	`POST /api/dashboard/account`	Change account username
Regenerate universal key	`POST /api/dashboard/account/api-key/regenerate`	Rotate management access
Revoke sessions	`POST /api/dashboard/account/revoke-other-sessions`	Sign out other browsers
List services	`GET /api/dashboard/services`	Read services
Create service	`POST /api/dashboard/services`	Create a service
Update service	`PATCH /api/dashboard/services/:serviceId`	Change service settings
Archive / restore / delete	`POST /api/dashboard/services/:serviceId/{archive\|restore\|delete}`	Change service lifecycle
Runtime credentials	`POST /api/dashboard/services/:serviceId/{runtime-key\|runtime-secret}/{regenerate\|reveal}`	Rotate or reveal service secrets
List or create scripts	`GET\|POST /api/dashboard/services/:serviceId/scripts`	Manage service scripts
Update or archive script	`PATCH /api/dashboard/scripts/:scriptId; POST .../{archive\|restore\|delete}`	Manage existing scripts
Builds	`GET /api/dashboard/scripts/:scriptId/builds; POST .../builds/:buildId/{use\|archive}`	Read and select saved builds
Generate license keys	`POST /api/dashboard/services/:serviceId/keys`	Issue customer keys
Manage license keys	`POST /api/dashboard/services/:serviceId/keys/:licenseId/{disable\|enable\|reset-device\|archive}`	Change customer access
Keys and devices	`GET /api/dashboard/all-keys; GET /api/dashboard/hwids; GET /api/dashboard/services/:serviceId/remembered-devices`	Audit access state
Remembered device	`POST /api/dashboard/remembered-devices/:deviceId/revoke`	Revoke a trusted device
Activity and stats	`GET /api/dashboard/stats; GET /api/dashboard/all-events`	Read workspace activity
Executions	`GET /api/dashboard/executions`	Read filtered loader execution counts and events
Webhooks	`GET\|POST /api/dashboard/webhooks; PATCH /api/dashboard/webhooks/:id; POST .../{test\|disable\|enable\|delete}`	Manage Discord event notifications
Integrations	`GET\|POST /api/lockers/connections; PATCH\|DELETE /api/lockers/connections/:id`	Manage provider connections
Rewards	`GET\|POST /api/lockers/gates; PATCH\|DELETE /api/lockers/gates/:id`	Manage reward gates
Obfuscation limits	`GET /api/obfuscation/limits?architecture=v3`	Read V3 quota
Obfuscate	`POST /api/obfuscation/run or /api/obfuscation/run-stream`	Run FlareFuscator
Bulk obfuscate	`POST /api/obfuscation/run-bulk`	Obfuscate many scripts in one request
Obfuscation history	`GET /api/obfuscation/history; GET\|DELETE /api/obfuscation/history/:jobId`	Read or delete outputs
Loader records	`GET\|POST /api/dashboard/script-loaders; PATCH\|DELETE /api/dashboard/script-loaders/:loaderId`	Manage saved loaders
Discord bot	`GET\|POST /api/dashboard/discord-bot and /api/dashboard/services/:serviceId/discord`	Manage Discord delivery settings
Team	`GET\|POST /api/dashboard/collaboration`	Manage workspace collaboration

Identity

Endpoint: GET /api/dashboard/me

Purpose: Read identity and preferences

Send the bearer key and use the returned user and permissions.

Request

http

GET /api/dashboard/me
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "user": {},
  "avatarUrl": "string",
  "discordUsername": "string",
  "impersonating": "string",
  "preferences": [],
  "theme": "string",
  "accent": "string",
  "accentHex": "string"
}

Account

Endpoint: GET /api/dashboard/account

Purpose: Read account and plan

Only the masked API-key preview and creation time are exposed.

Request

http

GET /api/dashboard/account
Authorization: Bearer fk_live_xxx

Update username

Endpoint: POST /api/dashboard/account

Purpose: Change account username

JSON body: { username }. The name must be 3–32 characters after normalization.

Request

http

POST /api/dashboard/account
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Request body

json

{
  "username": "string"
}

Response

json

{
  "ok": true,
  "data": {},
  "user": {}
}

Error codes: username_too_short, username_taken

Regenerate universal key

Endpoint: POST /api/dashboard/account/api-key/regenerate

Purpose: Rotate management access

Session-only action. Save the returned raw key before closing.

Request

http

POST /api/dashboard/account/api-key/regenerate
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "apiKey": "string"
}

Error codes: session_required_to_rotate_api_key

Revoke sessions

Endpoint: POST /api/dashboard/account/revoke-other-sessions

Purpose: Sign out other browsers

Use an active browser session when you need to preserve the current session.

Request

http

POST /api/dashboard/account/revoke-other-sessions
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "revoked": "string"
}

List services

Endpoint: GET /api/dashboard/services

Purpose: Read services

Use includeArchived=true for audit or restore flows.

HTTP request

http

GET /api/dashboard/services
Authorization: Bearer fk_live_xxx
Accept: application/json

Create service

Endpoint: POST /api/dashboard/services

Purpose: Create a service

JSON body: { name, description, requireHwidBinding, requireDiscordLink }. Save the one-time runtime credentials.

HTTP request

http

POST /api/dashboard/services
Authorization: Bearer fk_live_xxx
Content-Type: application/json

JSON body

json

{
  "name": "My service",
  "description": "Protected scripts",
  "requireHwidBinding": true,
  "requireDiscordLink": false
}

JSON response

json

{
  "ok": true,
  "service": { "id": "svc_xxx", "name": "My service" },
  "runtimeKey": "pk_live_xxx",
  "runtimeSecret": "0123456789abcdef..."
}

The returned runtimeKey and runtimeSecret are legacy/admin compatibility credentials. New v2 loaders and Script Library do not use the service runtime key; never ship either value to customers, and keep the runtime secret server-side for the optional TOTP/admin workflows.

Update service

Endpoint: PATCH /api/dashboard/services/:serviceId

Purpose: Change service settings

Send only changed fields and keep runtime secrets out of logs.

Request

http

PATCH /api/dashboard/services/:serviceId
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Request body

json

{
  "name": "string",
  "keySystemRememberDays": [],
  "getKeyUrl": "string",
  "sessionTtlMinutes": [],
  "ticketTtlSeconds": [],
  "status": "string",
  "description": "string"
}

Response

json

{
  "ok": true,
  "data": {},
  "service": {}
}

Error codes: service_not_found, invalid_service_name, automatic_guard_build_failed

Archive / restore / delete

Endpoint: POST /api/dashboard/services/:serviceId/{archive|restore|delete}

Purpose: Change service lifecycle

Archive blocks runtime loading. Delete is a soft delete retained for audit.

Request

http

POST /api/dashboard/services/:serviceId/archive
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "archived": "string"
}

Error codes: service_not_found

Runtime credentials

Endpoint: POST /api/dashboard/services/:serviceId/{runtime-key|runtime-secret}/{regenerate|reveal}

Purpose: Rotate or reveal service secrets

Regeneration invalidates the old value. Never send these values to customers.

Request

http

POST /api/dashboard/services/:serviceId/{runtime-key|runtime-secret}/regenerate

List or create scripts

Endpoint: GET|POST /api/dashboard/services/:serviceId/scripts

Purpose: Manage service scripts

POST JSON includes name, version, language, scriptType, status, content, and notes.

Request

http

GET /api/dashboard/services/:serviceId/scripts
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {}
}

Error codes: service_not_found

Update or archive script

Endpoint: PATCH /api/dashboard/scripts/:scriptId; POST .../{archive|restore|delete}

Purpose: Manage existing scripts

Use the script ID returned by the service endpoint.

Request

http

PATCH /api/dashboard/scripts/:scriptId
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Request body

json

{
  "name": "string",
  "content": "string",
  "language": "string",
  "scriptType": "string",
  "status": "string",
  "version": 0,
  "automaticTotpGuardEnabled": true,
  "ephemeralLoaderEnabled": true,
  "notes": [],
  "changelog": "string"
}

Response

json

{
  "ok": true,
  "data": {},
  "script": {}
}

Error codes: script_not_found, service_not_found, invalid_script_name, script_too_large, automatic_guard_build_failed

Builds

Endpoint: GET /api/dashboard/scripts/:scriptId/builds; POST .../builds/:buildId/{use|archive}

Purpose: Read and select saved builds

Use a build after checking its status and output metadata.

Request

http

GET /api/dashboard/scripts/:scriptId/builds
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {}
}

Error codes: script_not_found

Generate license keys

Endpoint: POST /api/dashboard/services/:serviceId/keys

Purpose: Issue customer keys

JSON includes quantity, plan, scriptId, serviceWide, expiry, customer fields, and HWID options.

Request

http

POST /api/dashboard/services/:serviceId/keys
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Request body

json

{
  "quantity": "string",
  "serviceWide": "string",
  "scriptId": "string",
  "plan": "string",
  "expiresAt": "string",
  "customerEmail": "string",
  "customerDiscordId": "string",
  "requireHwidBinding": true,
  "customerName": "string",
  "notes": []
}

Response

json

{
  "ok": true,
  "data": {},
  "keys": []
}

Error codes: service_not_found

Manage license keys

Endpoint: POST /api/dashboard/services/:serviceId/keys/:licenseId/{disable|enable|reset-device|archive}

Purpose: Change customer access

Reset-device rotates the raw key and revokes runtime sessions for that license.

Request

http

POST /api/dashboard/services/:serviceId/keys/:licenseId/disable

Keys and devices

Endpoint: GET /api/dashboard/all-keys; GET /api/dashboard/hwids; GET /api/dashboard/services/:serviceId/remembered-devices

Purpose: Audit access state

Users with the service's Manage Keys permission can read and copy the full license key. Other workspace roles receive only the permitted preview and IDs.

Request

http

GET /api/dashboard/all-keys
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "keys": []
}

Remembered device

Endpoint: POST /api/dashboard/remembered-devices/:deviceId/revoke

Purpose: Revoke a trusted device

The next runtime attempt must verify again.

Request

http

POST /api/dashboard/remembered-devices/:deviceId/revoke
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "revoked": "string",
  "alreadyRevoked": "string"
}

Error codes: device_not_found, service_not_found

Activity and stats

Endpoint: GET /api/dashboard/stats; GET /api/dashboard/all-events

Purpose: Read workspace activity

Use for dashboards and audit trails; these do not mutate state.

Request

http

GET /api/dashboard/stats
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "recentScripts": [],
  "plan": "string",
  "limits": []
}

Executions

Endpoint: GET /api/dashboard/executions

Purpose: Read filtered loader-execution totals, chart buckets, scripts, and recent events

Query parameters

http

?range=day|week|month|year|custom&start=YYYY-MM-DD&end=YYYY-MM-DD&scriptIds=scr_xxx,scr_yyy&result=all|success|failed

range defaults to week. For custom, provide inclusive start and end dates; the maximum range is 366 days. scriptIds is an optional comma-separated list of up to 100 scripts. The result includes zero-filled time buckets, totals, per-script counts, and up to 500 recent matching events. Day-sized ranges use hourly buckets, longer custom/week/month ranges use daily buckets, and year uses weekly buckets.

Request

http

GET /api/dashboard/executions?range=custom&start=2026-09-01&end=2026-09-07&scriptIds=scr_xxx,scr_yyy&result=failed
Authorization: Bearer fk_live_xxx

Response shape

json

{
  "ok": true,
  "data": {
    "range": "custom",
    "bucket": "day",
    "scripts": [],
    "series": [],
    "events": [],
    "totals": { "total": 0, "success": 0, "failed": 0 }
  }
}

The generated-loader beacon is recorded when FlareKey receives a start report; it does not prove that protected source finished. Custom /v1/runtime/log events are activity records and are not included in execution totals.

Webhooks

Endpoint: GET|POST /api/dashboard/webhooks; PATCH /api/dashboard/webhooks/:id; POST /api/dashboard/webhooks/:id/{test|disable|enable|delete}

Purpose: Send selected FlareKey events to a Discord channel

This feature accepts Discord incoming-webhook URLs only. Configure one webhook per service, choose its event types, and use the test action to check delivery. There is no generic destination URL or signing-secret setup. Keep the Discord URL private because it contains the token Discord uses to accept messages. The test action sends a sample key.verified event; select that event for a test message to be delivered.

Request

http

GET /api/dashboard/webhooks
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {
    "webhooks": [],
    "deliveries": []
  }
}

Discord messages are embeds containing the event result, service, script, and available details. Some event types include the full license key or raw HWID when FlareKey has that value; send them only to a private channel with trusted members. Available event types are key.created, key.verified, key.failed, key.disabled, key.enabled, key.device_reset, key.archived, key.device_bound, key.device_mismatch, session.created, script.ticket_created, script.downloaded, runtime.loader, and runtime.log.

Integrations

Endpoint: GET|POST /api/lockers/connections; PATCH|DELETE /api/lockers/connections/:id

Purpose: Manage provider connections

Keep provider tokens server-side and scope them to a service.

Request

http

GET /api/lockers/connections
Authorization: Bearer fk_live_xxx

Query parameters

http

?serviceId=<value>

Error codes: service_not_found

Rewards

Endpoint: GET|POST /api/lockers/gates; PATCH|DELETE /api/lockers/gates/:id

Purpose: Manage reward gates

Build gates from linked connections and append or reorder their steps.

Request

http

GET /api/lockers/gates
Authorization: Bearer fk_live_xxx

Query parameters

http

?serviceId=<value>

Response

json

{
  "ok": true,
  "data": {},
  "gates": []
}

Error codes: service_not_found

Obfuscation limits

Endpoint: GET /api/obfuscation/limits?architecture=v3

Purpose: Read V3 quota

Query before submitting a build.

Request

http

GET /api/obfuscation/limits
Authorization: Bearer fk_live_xxx

Obfuscate

Endpoint: POST /api/obfuscation/run or /api/obfuscation/run-stream

Purpose: Run FlareFuscator

JSON body: { source, architecture: "v3", serviceId?, scriptId?, performance?, noWatermark?, requireRobloxRuntime?, featherlua?, featherluaMode? }. Use run-stream for progress events.

HTTP request

http

POST /api/obfuscation/run
Authorization: Bearer fk_live_xxx
Content-Type: application/json

JSON body

json

{
  "source": "print(\\"hello\\")",
  "architecture": "v3",
  "serviceId": "svc_xxx",
  "scriptId": "scr_xxx",
  "performance": false,
  "noWatermark": false,
  "requireRobloxRuntime": true,
  "featherlua": true,
  "featherluaMode": "aggressive"
}

Bulk obfuscate

Endpoint: POST /api/obfuscation/run-bulk

Purpose: Obfuscate many scripts in one request

API-key only. JSON body: { architecture: "v3", scripts: [{ source, name?, serviceId?, ... }] }. All-or-nothing on credits: if the batch is larger than your remaining quota nothing runs and creditsRemaining is returned. Each script charges 1 credit on success, 0 on failure. Max 50 per batch.

Bulk HTTP request

http

POST /api/obfuscation/run-bulk
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Bulk JSON body

json

{
  "architecture": "v3",
  "scripts": [
    { "source": "print(\\"a\\")", "name": "a.lua" },
    { "source": "print(\\"b\\")", "name": "b.lua", "performance": true }
  ]
}

Bulk JSON response

json

{
  "ok": true,
  "architecture": "v3",
  "compilerVersion": "v3",
  "total": 2,
  "succeeded": 2,
  "failed": 0,
  "results": [
    { "index": 0, "name": "a.lua", "ok": true, "jobId": "obf_xxx", "bytesIn": 12, "bytesOut": 340 },
    { "index": 1, "name": "b.lua", "ok": true, "jobId": "obf_yyy", "bytesIn": 12, "bytesOut": 351 }
  ],
  "data": { "credits": { "remaining": 0, "unlimited": false, "limitingWindow": "day" } }
}

Not enough credits (429)

json

{
  "ok": false,
  "code": "insufficient_credits",
  "error": "Obfuscation failed: not enough obfuscation credits.",
  "requested": 3,
  "creditsRemaining": 2,
  "limitType": "day",
  "data": {
    "message": "You need 3 obfuscation credits but only 2 are left.",
    "credits": { "remaining": 2, "unlimited": false, "limitingWindow": "day" }
  }
}

Obfuscation history

Endpoint: GET /api/obfuscation/history; GET|DELETE /api/obfuscation/history/:jobId

Purpose: Read or delete outputs

The detail endpoint returns code only while retention is active.

Request

http

GET /api/obfuscation/history
Authorization: Bearer fk_live_xxx

Loader records

Endpoint: GET|POST /api/dashboard/script-loaders; PATCH|DELETE /api/dashboard/script-loaders/:loaderId

Purpose: Manage saved loaders

The service runtime key and runtime secret are legacy/admin compatibility credentials. New session-bound v2 loaders and Script Library use scoped short-lived tokens instead; keep these values out of shipped loaders.

Request

http

GET /api/dashboard/script-loaders
Authorization: Bearer fk_live_xxx

Query parameters

http

?serviceId=<value>

Response

json

{
  "ok": true,
  "data": {},
  "loaders": []
}

Error codes: service_not_found

Discord bot

Endpoint: GET|POST /api/dashboard/discord-bot and /api/dashboard/services/:serviceId/discord

Purpose: Manage Discord delivery settings

Use the service ID and keep bot credentials on the server.

Request

http

GET /api/dashboard/discord-bot and /api/dashboard/services/:serviceId/discord

Team

Endpoint: GET|POST /api/dashboard/collaboration

Purpose: Manage workspace collaboration

Member invites and role changes remain permission-checked.

Request

http

GET /api/dashboard/collaboration
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {}
}

API Reference ​

Runtime API ​

Verify license ​

Resume device ​

Check session ​

Create ticket ​

Download script ​

Runtime telemetry (preauth-tamper) ​

Runtime telemetry (preauth-failure) ​

Runtime telemetry (failure) ​

Runtime telemetry (tamper) ​

Script telemetry ​

Runtime probe ​

Clearance ​

Runtime library ​

Loader execution report ​

Custom runtime log ​

Runtime SDK source ​

Dashboard API ​

Identity ​

Account ​

Update username ​

Regenerate universal key ​

Revoke sessions ​

List services ​

Create service ​

Update service ​

Archive / restore / delete ​

Runtime credentials ​

List or create scripts ​

Update or archive script ​

Builds ​

Generate license keys ​

Manage license keys ​

Keys and devices ​

Remembered device ​

Activity and stats ​

Executions ​

Webhooks ​

Integrations ​

Rewards ​

Obfuscation limits ​

Obfuscate ​

Bulk obfuscate ​

Obfuscation history ​

Loader records ​

Discord bot ​

Team ​

API Reference

Runtime API

Verify license

Resume device

Check session

Create ticket

Download script

Runtime telemetry (preauth-tamper)

Runtime telemetry (preauth-failure)

Runtime telemetry (failure)

Runtime telemetry (tamper)

Script telemetry

Runtime probe

Clearance

Runtime library

Loader execution report

Custom runtime log

Runtime SDK source

Dashboard API

Identity

Account

Update username

Regenerate universal key

Revoke sessions

List services

Create service

Update service

Archive / restore / delete

Runtime credentials

List or create scripts

Update or archive script

Builds

Generate license keys

Manage license keys

Keys and devices

Remembered device

Activity and stats

Executions

Webhooks

Integrations

Rewards

Obfuscation limits

Obfuscate

Bulk obfuscate

Obfuscation history

Loader records

Discord bot

Team