API Reference

The complete FlareKey API reference in two parts: runtime delivery for loaders, and dashboard management for your own workspace.

About these examples

Header, query, body and response field names are extracted from the request handlers by tools/extract-route-facts.js. Values shown are placeholders that indicate shape, not fixed literals.

Runtime API

Use these public-facing endpoints from a v2 loader or trusted runtime client. The customer license starts a session; signed clearance, an exact-build ticket, and signed download metadata authorize one protected delivery.

Start with license verification. Keep the same service ID, device ID, script ID, session-bound protocol headers, and session token for the whole attempt.
After verification, send the returned session token as a bearer token. Request a single-use ticket immediately before running the protected source and download it once.
Treat errors as machine-readable outcomes. Back off on rate_limited, re-verify on session_expired, and request a new ticket on ticket_used or ticket_expired.

Route	Endpoint	Use it for
Verify license	`POST /v1/licenses/verify`	Create a runtime session
Resume device	`POST /v1/licenses/remember`	Resume a remembered device
Check session	`POST /v1/sessions/check`	Confirm a session is active
Create ticket	`POST /v1/scripts/:scriptId/ticket`	Authorize one protected download
Download script	`GET /v1/scripts/download`	Fetch protected source
Runtime telemetry (preauth-tamper)	`POST /v1/runtime/preauth-tamper`	Report pre-auth tamper
Runtime telemetry (preauth-failure)	`POST /v1/runtime/preauth-failure`	Report failed preflight
Runtime telemetry (failure)	`POST /v1/runtime/failure`	Report a runtime guard failure
Runtime telemetry (tamper)	`POST /v1/runtime/tamper`	Report authenticated tamper
Script telemetry	`POST /v1/scripts/:scriptId/tamper`	Report script tamper
Runtime probe	`POST /v1/runtime/echo`	Run the runtime echo probe
Clearance	`POST /v1/runtime/clearance`	Obtain runtime clearance
Runtime library	`GET /v1/lib/:serviceId`	Fetch the FlareKey UI library

Verify license

Endpoint: POST /v1/licenses/verify

Purpose: Create a runtime session

Send x-service-id, x-flare-session-bound, x-flare-protocol: 2, licenseKey, deviceId, and scriptId. Store the signed challenge and sessionToken; do not expect source.

HTTP request

http

POST /v1/licenses/verify
Content-Type: application/json
x-service-id: svc_xxx
x-flare-session-bound: rsa-sha256-v1
x-flare-protocol: 2

JSON body

json

{
  "licenseKey": "FLARE-XXXX-XXXX-XXXX-XXXX",
  "deviceId": "device_123",
  "fingerprint": "optional_fingerprint",
  "scriptId": "scr_xxx",
  "metadata": {
    "executor": "example",
    "loaderVersion": "1.0.0"
  }
}

JSON response

json

{
  "ok": true,
  "status": "active",
  "sessionToken": "api_sess_xxx",
  "expiresIn": 600,
  "license": { "id": "lic_xxx", "serviceId": "svc_xxx", "scriptId": "scr_xxx", "deviceBound": true }
}

Resume device

Endpoint: POST /v1/licenses/remember

Purpose: Resume a remembered device

Send the opaque remember token and current device identity. Fall back to verify if it is revoked or expired.

Request

http

POST /v1/licenses/remember
Authorization: Bearer api_sess_xxx
x-service-id: <value>
x-runtime-key: <value>
Content-Type: application/json

Request body

json

{
  "serviceId": "string",
  "scriptId": "string",
  "rememberToken": "string"
}

Error codes: remember_resumed, blacklisted

Check session

Endpoint: POST /v1/sessions/check

Purpose: Confirm a session is active

Send Authorization: Bearer api_sess_xxx before another protected action.

Request

http

POST /v1/sessions/check

Response

json

{
  "ok": true,
  "serviceId": "string",
  "scriptId": "string",
  "licenseId": "string",
  "expiresAt": "string"
}

Error codes: invalid_session

Create ticket

Endpoint: POST /v1/scripts/:scriptId/ticket

Purpose: Authorize one protected download

Call immediately before download. The ticket is short-lived, script-bound, and single-use.

HTTP request

http

POST /v1/scripts/scr_xxx/ticket
Authorization: Bearer api_sess_xxx
Content-Type: application/json

JSON body

json

{ "reason": "load_protected_source" }

JSON response

json

{
  "ok": true,
  "protocolVersion": 2,
  "ticket": "ticket_xxx",
  "buildId": "bld_xxx",
  "artifactSha256": "64-lowercase-hex",
  "downloadUrl": "/v1/scripts/download",
  "expiresIn": 60
}

Download script

Endpoint: GET /v1/scripts/download

Purpose: Fetch protected source

Send the ticket in x-flare-ticket exactly once. The response is signed and identifies the frozen build and payload hash.

HTTP request

http

GET /v1/scripts/download
x-flare-ticket: ticket_xxx

Runtime telemetry (preauth-tamper)

Endpoint: POST /v1/runtime/preauth-tamper

Purpose: Report pre-auth tamper

Send the runtime signal when a preflight check detects tampering.

Request

http

POST /v1/runtime/preauth-tamper

Runtime telemetry (preauth-failure)

Endpoint: POST /v1/runtime/preauth-failure

Purpose: Report failed preflight

Send the failure context selected by the runtime preflight response.

Request

http

POST /v1/runtime/preauth-failure

Error codes: invalid_runtime_failure

Runtime telemetry (failure)

Endpoint: POST /v1/runtime/failure

Purpose: Report a runtime guard failure

Send the authenticated session and failure reason before stopping.

Request

http

POST /v1/runtime/failure

Error codes: runtime_fail_closed, invalid_session, invalid_binding, wrong_script, missing_nonce, invalid_runtime_failure, invalid_script, invalid_license

Runtime telemetry (tamper)

Endpoint: POST /v1/runtime/tamper

Purpose: Report authenticated tamper

Send the session-bound tamper event; never expose management credentials.

Request

http

POST /v1/runtime/tamper

Error codes: invalid_session, invalid_binding, wrong_script, missing_nonce, invalid_script, invalid_license, invalid_tamper_report, tamper_detected

Script telemetry

Endpoint: POST /v1/scripts/:scriptId/tamper

Purpose: Report script tamper

Send the authenticated session and script-specific signal.

Request

http

POST /v1/scripts/:scriptId/tamper

Response

json

{
  "ok": true,
  "blacklisted": "string",
  "expiresIn": 0
}

Error codes: invalid_session, license_not_found

Runtime probe

Endpoint: POST /v1/runtime/echo

Purpose: Run the runtime echo probe

Use only with the session and challenge fields supplied by the runtime flow.

Request

http

POST /v1/runtime/echo

Error codes: echo, invalid_session

Clearance

Endpoint: POST /v1/runtime/clearance

Purpose: Obtain runtime clearance

Send the authenticated preflight transcript; the server decides whether it is valid.

Request

http

POST /v1/runtime/clearance

Error codes: invalid_session, invalid_script, service_archived, script_disabled, wrong_script, loader_unavailable, preflight_protocol_failed, tamper_detected

Runtime library

Endpoint: GET /v1/lib/:serviceId

Purpose: Fetch the FlareKey UI library

Use the service ID and runtime flow. Never put dashboard API keys in a loader.

Request

http

GET /v1/lib/:serviceId

Query parameters

http

?scriptId=<value>

Dashboard API

Use the universal API key from Settings for private workspace actions. Send it as Authorization: Bearer fk_live_xxx. API-key requests do not need browser x-flare-action or CSRF headers; rotating the key itself still requires a signed-in browser session.

Generate or regenerate the universal key from Settings → Universal API key. The raw key is shown once; if it is lost, regenerate it. Treat it like a password and never place it in a loader or customer-facing script.
Use the key for service creation/deletion, script creation, key management, dashboard reads, and obfuscation. Every action is still scoped to the authenticated workspace and owner/member permissions.
GET requests return workspace data. POST, PATCH, and DELETE requests perform management changes; send JSON bodies where the action table says a body is required.
The browser UI continues to use its signed session and CSRF protection. The universal API key is for private integrations and server-side automation.

Route	Endpoint	Use it for
Identity	`GET /api/dashboard/me`	Read identity and preferences
Account	`GET /api/dashboard/account`	Read account and plan
Update username	`POST /api/dashboard/account`	Change account username
Regenerate universal key	`POST /api/dashboard/account/api-key/regenerate`	Rotate management access
Revoke sessions	`POST /api/dashboard/account/revoke-other-sessions`	Sign out other browsers
List services	`GET /api/dashboard/services`	Read services
Create service	`POST /api/dashboard/services`	Create a service
Update service	`PATCH /api/dashboard/services/:serviceId`	Change service settings
Archive / restore / delete	`POST /api/dashboard/services/:serviceId/{archive\|restore\|delete}`	Change service lifecycle
Runtime credentials	`POST /api/dashboard/services/:serviceId/{runtime-key\|runtime-secret}/{regenerate\|reveal}`	Rotate or reveal service secrets
List or create scripts	`GET\|POST /api/dashboard/services/:serviceId/scripts`	Manage service scripts
Update or archive script	`PATCH /api/dashboard/scripts/:scriptId; POST .../{archive\|restore\|delete}`	Manage existing scripts
Builds	`GET /api/dashboard/scripts/:scriptId/builds; POST .../builds/:buildId/{use\|archive}`	Read and select saved builds
Generate license keys	`POST /api/dashboard/services/:serviceId/keys`	Issue customer keys
Manage license keys	`POST /api/dashboard/services/:serviceId/keys/:licenseId/{disable\|enable\|reset-device\|archive}`	Change customer access
Keys and devices	`GET /api/dashboard/all-keys; GET /api/dashboard/hwids; GET /api/dashboard/services/:serviceId/remembered-devices`	Audit access state
Remembered device	`POST /api/dashboard/remembered-devices/:deviceId/revoke`	Revoke a trusted device
Activity and stats	`GET /api/dashboard/stats; GET /api/dashboard/all-events`	Read workspace activity
Webhooks	`GET\|POST /api/dashboard/webhooks; POST /api/dashboard/webhooks/:id/{test\|disable\|enable\|delete}`	Manage signed delivery
Integrations	`GET\|POST /api/lockers/connections; PATCH\|DELETE /api/lockers/connections/:id`	Manage provider connections
Rewards	`GET\|POST /api/lockers/gates; PATCH\|DELETE /api/lockers/gates/:id`	Manage reward gates
Obfuscation limits	`GET /api/obfuscation/limits?preset=maximum`	Read Maximum quota
Obfuscate	`POST /api/obfuscation/run or /api/obfuscation/run-stream`	Run FlareFuscator
Bulk obfuscate	`POST /api/obfuscation/run-bulk`	Obfuscate many scripts in one request
Obfuscation history	`GET /api/obfuscation/history; GET\|DELETE /api/obfuscation/history/:jobId`	Read or delete outputs
Loader records	`GET\|POST /api/dashboard/script-loaders; PATCH\|DELETE /api/dashboard/script-loaders/:loaderId`	Manage saved loaders
Discord bot	`GET\|POST /api/dashboard/discord-bot and /api/dashboard/services/:serviceId/discord`	Manage Discord delivery settings
Team	`GET\|POST /api/dashboard/collaboration`	Manage workspace collaboration

Identity

Endpoint: GET /api/dashboard/me

Purpose: Read identity and preferences

Send the bearer key and use the returned user and permissions.

Request

http

GET /api/dashboard/me
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "user": {},
  "avatarUrl": "string",
  "discordUsername": "string",
  "impersonating": "string",
  "preferences": [],
  "theme": "string",
  "accent": "string",
  "accentHex": "string"
}

Account

Endpoint: GET /api/dashboard/account

Purpose: Read account and plan

Only the masked API-key preview and creation time are exposed.

Request

http

GET /api/dashboard/account
Authorization: Bearer fk_live_xxx

Update username

Endpoint: POST /api/dashboard/account

Purpose: Change account username

JSON body: { username }. The name must be 3–32 characters after normalization.

Request

http

POST /api/dashboard/account
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Request body

json

{
  "username": "string"
}

Response

json

{
  "ok": true,
  "data": {},
  "user": {}
}

Error codes: username_too_short, username_taken

Regenerate universal key

Endpoint: POST /api/dashboard/account/api-key/regenerate

Purpose: Rotate management access

Session-only action. Save the returned raw key before closing.

Request

http

POST /api/dashboard/account/api-key/regenerate
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "apiKey": "string"
}

Error codes: session_required_to_rotate_api_key

Revoke sessions

Endpoint: POST /api/dashboard/account/revoke-other-sessions

Purpose: Sign out other browsers

Use an active browser session when you need to preserve the current session.

Request

http

POST /api/dashboard/account/revoke-other-sessions
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "revoked": "string"
}

List services

Endpoint: GET /api/dashboard/services

Purpose: Read services

Use includeArchived=true for audit or restore flows.

HTTP request

http

GET /api/dashboard/services
Authorization: Bearer fk_live_xxx
Accept: application/json

Create service

Endpoint: POST /api/dashboard/services

Purpose: Create a service

JSON body: { name, description, requireHwidBinding, requireDiscordLink }. Save the one-time runtime credentials.

HTTP request

http

POST /api/dashboard/services
Authorization: Bearer fk_live_xxx
Content-Type: application/json

JSON body

json

{
  "name": "My service",
  "description": "Protected scripts",
  "requireHwidBinding": true,
  "requireDiscordLink": false
}

JSON response

json

{
  "ok": true,
  "service": { "id": "svc_xxx", "name": "My service" },
  "runtimeKey": "pk_live_xxx",
  "runtimeSecret": "0123456789abcdef..."
}

Update service

Endpoint: PATCH /api/dashboard/services/:serviceId

Purpose: Change service settings

Send only changed fields and keep runtime secrets out of logs.

Request

http

PATCH /api/dashboard/services/:serviceId
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Request body

json

{
  "name": "string",
  "keySystemRememberDays": [],
  "getKeyUrl": "string",
  "sessionTtlMinutes": [],
  "ticketTtlSeconds": [],
  "status": "string",
  "description": "string"
}

Response

json

{
  "ok": true,
  "data": {},
  "service": {}
}

Error codes: service_not_found, invalid_service_name, automatic_guard_build_failed

Archive / restore / delete

Endpoint: POST /api/dashboard/services/:serviceId/{archive|restore|delete}

Purpose: Change service lifecycle

Archive blocks runtime loading. Delete is a soft delete retained for audit.

Request

http

POST /api/dashboard/services/:serviceId/archive
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "archived": "string"
}

Error codes: service_not_found

Runtime credentials

Endpoint: POST /api/dashboard/services/:serviceId/{runtime-key|runtime-secret}/{regenerate|reveal}

Purpose: Rotate or reveal service secrets

Regeneration invalidates the old value. Never send these values to customers.

Request

http

POST /api/dashboard/services/:serviceId/{runtime-key|runtime-secret}/regenerate

List or create scripts

Endpoint: GET|POST /api/dashboard/services/:serviceId/scripts

Purpose: Manage service scripts

POST JSON includes name, version, language, scriptType, status, content, and notes.

Request

http

GET /api/dashboard/services/:serviceId/scripts
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {}
}

Error codes: service_not_found

Update or archive script

Endpoint: PATCH /api/dashboard/scripts/:scriptId; POST .../{archive|restore|delete}

Purpose: Manage existing scripts

Use the script ID returned by the service endpoint.

Request

http

PATCH /api/dashboard/scripts/:scriptId
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Request body

json

{
  "name": "string",
  "content": "string",
  "language": "string",
  "scriptType": "string",
  "status": "string",
  "version": 0,
  "automaticTotpGuardEnabled": true,
  "ephemeralLoaderEnabled": true,
  "notes": [],
  "changelog": "string"
}

Response

json

{
  "ok": true,
  "data": {},
  "script": {}
}

Error codes: script_not_found, service_not_found, invalid_script_name, script_too_large, automatic_guard_build_failed

Builds

Endpoint: GET /api/dashboard/scripts/:scriptId/builds; POST .../builds/:buildId/{use|archive}

Purpose: Read and select saved builds

Use a build after checking its status and output metadata.

Request

http

GET /api/dashboard/scripts/:scriptId/builds
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {}
}

Error codes: script_not_found

Generate license keys

Endpoint: POST /api/dashboard/services/:serviceId/keys

Purpose: Issue customer keys

JSON includes quantity, plan, scriptId, serviceWide, expiry, customer fields, and HWID options.

Request

http

POST /api/dashboard/services/:serviceId/keys
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Request body

json

{
  "quantity": "string",
  "serviceWide": "string",
  "scriptId": "string",
  "plan": "string",
  "expiresAt": "string",
  "customerEmail": "string",
  "customerDiscordId": "string",
  "requireHwidBinding": true,
  "customerName": "string",
  "notes": []
}

Response

json

{
  "ok": true,
  "data": {},
  "keys": []
}

Error codes: service_not_found

Manage license keys

Endpoint: POST /api/dashboard/services/:serviceId/keys/:licenseId/{disable|enable|reset-device|archive}

Purpose: Change customer access

Reset-device rotates the raw key and revokes runtime sessions for that license.

Request

http

POST /api/dashboard/services/:serviceId/keys/:licenseId/disable

Keys and devices

Endpoint: GET /api/dashboard/all-keys; GET /api/dashboard/hwids; GET /api/dashboard/services/:serviceId/remembered-devices

Purpose: Audit access state

Use previews and IDs; raw values require explicit one-time actions.

Request

http

GET /api/dashboard/all-keys
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "keys": []
}

Remembered device

Endpoint: POST /api/dashboard/remembered-devices/:deviceId/revoke

Purpose: Revoke a trusted device

The next runtime attempt must verify again.

Request

http

POST /api/dashboard/remembered-devices/:deviceId/revoke
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "revoked": "string",
  "alreadyRevoked": "string"
}

Error codes: device_not_found, service_not_found

Activity and stats

Endpoint: GET /api/dashboard/stats; GET /api/dashboard/all-events

Purpose: Read workspace activity

Use for dashboards and audit trails; these do not mutate state.

Request

http

GET /api/dashboard/stats
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "recentScripts": [],
  "plan": "string",
  "limits": []
}

Webhooks

Endpoint: GET|POST /api/dashboard/webhooks; POST /api/dashboard/webhooks/:id/{test|disable|enable|delete}

Purpose: Manage signed delivery

POST JSON includes url and events. Save the one-time signing secret.

Request

http

GET /api/dashboard/webhooks
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {},
  "webhooks": []
}

Integrations

Endpoint: GET|POST /api/lockers/connections; PATCH|DELETE /api/lockers/connections/:id

Purpose: Manage provider connections

Keep provider tokens server-side and scope them to a service.

Request

http

GET /api/lockers/connections
Authorization: Bearer fk_live_xxx

Query parameters

http

?serviceId=<value>

Error codes: service_not_found

Rewards

Endpoint: GET|POST /api/lockers/gates; PATCH|DELETE /api/lockers/gates/:id

Purpose: Manage reward gates

Build gates from linked connections and append or reorder their steps.

Request

http

GET /api/lockers/gates
Authorization: Bearer fk_live_xxx

Query parameters

http

?serviceId=<value>

Response

json

{
  "ok": true,
  "data": {},
  "gates": []
}

Error codes: service_not_found

Obfuscation limits

Endpoint: GET /api/obfuscation/limits?preset=maximum

Purpose: Read Maximum quota

Query before submitting a build.

Request

http

GET /api/obfuscation/limits
Authorization: Bearer fk_live_xxx

Obfuscate

Endpoint: POST /api/obfuscation/run or /api/obfuscation/run-stream

Purpose: Run FlareFuscator

JSON body: { source, preset: "maximum", serviceId?, scriptId?, performance?, noWatermark?, requireRobloxRuntime?, featherlua?, featherluaMode? }. Use run-stream for progress events.

HTTP request

http

POST /api/obfuscation/run
Authorization: Bearer fk_live_xxx
Content-Type: application/json

JSON body

json

{
  "source": "print(\\"hello\\")",
  "preset": "maximum",
  "serviceId": "svc_xxx",
  "scriptId": "scr_xxx",
  "performance": false,
  "noWatermark": false,
  "requireRobloxRuntime": true,
  "featherlua": true,
  "featherluaMode": "aggressive"
}

Bulk obfuscate

Endpoint: POST /api/obfuscation/run-bulk

Purpose: Obfuscate many scripts in one request

API-key only. JSON body: { preset: "maximum", scripts: [{ source, name?, serviceId?, ... }] }. All-or-nothing on credits: if the batch is larger than your remaining quota nothing runs and creditsRemaining is returned. Each script charges 1 credit on success, 0 on failure. Max 50 per batch.

Bulk HTTP request

http

POST /api/obfuscation/run-bulk
Authorization: Bearer fk_live_xxx
Content-Type: application/json

Bulk JSON body

json

{
  "preset": "maximum",
  "scripts": [
    { "source": "print(\\"a\\")", "name": "a.lua" },
    { "source": "print(\\"b\\")", "name": "b.lua", "performance": true }
  ]
}

Bulk JSON response

json

{
  "ok": true,
  "preset": "maximum",
  "total": 2,
  "succeeded": 2,
  "failed": 0,
  "results": [
    { "index": 0, "name": "a.lua", "ok": true, "jobId": "obf_xxx", "bytesIn": 12, "bytesOut": 340 },
    { "index": 1, "name": "b.lua", "ok": true, "jobId": "obf_yyy", "bytesIn": 12, "bytesOut": 351 }
  ],
  "data": { "credits": { "remaining": 0, "unlimited": false, "limitingWindow": "day" } }
}

Not enough credits (429)

json

{
  "ok": false,
  "code": "insufficient_credits",
  "error": "Obfuscation failed: not enough obfuscation credits.",
  "requested": 3,
  "creditsRemaining": 2,
  "limitType": "day",
  "data": {
    "message": "You need 3 obfuscation credits but only 2 are left.",
    "credits": { "remaining": 2, "unlimited": false, "limitingWindow": "day" }
  }
}

Obfuscation history

Endpoint: GET /api/obfuscation/history; GET|DELETE /api/obfuscation/history/:jobId

Purpose: Read or delete outputs

The detail endpoint returns code only while retention is active.

Request

http

GET /api/obfuscation/history
Authorization: Bearer fk_live_xxx

Loader records

Endpoint: GET|POST /api/dashboard/script-loaders; PATCH|DELETE /api/dashboard/script-loaders/:loaderId

Purpose: Manage saved loaders

Runtime keys remain service credentials and are not replaced by the universal key.

Request

http

GET /api/dashboard/script-loaders
Authorization: Bearer fk_live_xxx

Query parameters

http

?serviceId=<value>

Response

json

{
  "ok": true,
  "data": {},
  "loaders": []
}

Error codes: service_not_found

Discord bot

Endpoint: GET|POST /api/dashboard/discord-bot and /api/dashboard/services/:serviceId/discord

Purpose: Manage Discord delivery settings

Use the service ID and keep bot credentials on the server.

Request

http

GET /api/dashboard/discord-bot and /api/dashboard/services/:serviceId/discord

Team

Endpoint: GET|POST /api/dashboard/collaboration

Purpose: Manage workspace collaboration

Member invites and role changes remain permission-checked.

Request

http

GET /api/dashboard/collaboration
Authorization: Bearer fk_live_xxx

Response

json

{
  "ok": true,
  "data": {}
}

API Reference ​

Runtime API ​

Verify license ​

Resume device ​

Check session ​

Create ticket ​

Download script ​

Runtime telemetry (preauth-tamper) ​

Runtime telemetry (preauth-failure) ​

Runtime telemetry (failure) ​

Runtime telemetry (tamper) ​

Script telemetry ​

Runtime probe ​

Clearance ​

Runtime library ​

Dashboard API ​

Identity ​

Account ​

Update username ​

Regenerate universal key ​

Revoke sessions ​

List services ​

Create service ​

Update service ​

Archive / restore / delete ​

Runtime credentials ​

List or create scripts ​

Update or archive script ​

Builds ​

Generate license keys ​

Manage license keys ​

Keys and devices ​

Remembered device ​

Activity and stats ​

Webhooks ​

Integrations ​

Rewards ​

Obfuscation limits ​

Obfuscate ​

Bulk obfuscate ​

Obfuscation history ​

Loader records ​

Discord bot ​

Team ​

API Reference

Runtime API

Verify license

Resume device

Check session

Create ticket

Download script

Runtime telemetry (preauth-tamper)

Runtime telemetry (preauth-failure)

Runtime telemetry (failure)

Runtime telemetry (tamper)

Script telemetry

Runtime probe

Clearance

Runtime library

Dashboard API

Identity

Account

Update username

Regenerate universal key

Revoke sessions

List services

Create service

Update service

Archive / restore / delete

Runtime credentials

List or create scripts

Update or archive script

Builds

Generate license keys

Manage license keys

Keys and devices

Remembered device

Activity and stats

Webhooks

Integrations

Rewards

Obfuscation limits

Obfuscate

Bulk obfuscate

Obfuscation history

Loader records

Discord bot

Team