Auth API reference (owners)

Endpoint

POST https://luasecure.xyz/files/v4/auth
Content-Type: application/json
Accept: application/json

This endpoint validates script access. It is not an API for creating projects or licenses. Never send Supabase service-role credentials to clients.

Field	Value
`script`	32-character lowercase hex file ID.
`key`	License key; empty string for keyless scripts. Maximum 256 characters.
`hwid`	Nonempty client hardware ID, maximum 256 characters. UNKNOWN-HWID is rejected.
`ticket`	Omit for the first request. Include the returned ticket for the second.

1. Request a ticket

{
  "script": "YOUR_SCRIPT_FILE_ID",
  "key": "YOUR_LICENSE_KEY",
  "hwid": "YOUR_DEVICE_ID"
}

A successful HTTP 200 response:

{
  "success": true,
  "ticket": "ONE_TIME_TICKET",
  "code": "OK"
}

2. Exchange the ticket

Repeat the same fields and add ticket. Preserve the exact key and HWID strings. The ticket is bound to those strings and the script ID, expires after two minutes, and is consumed once. Access is checked again before delivery.

{
  "success": true,
  "payload": "ENCODED_PAYLOAD",
  "nonce": "RANDOM_NONCE",
  "sha256": "SHA256_OF_DECODED_SOURCE",
  "enc": "x1",
  "code": "OK"
}

The standard loader handles the x1 payload format. A server with LOADER_ENC=0 returns plain source in payload. Do not evaluate an API response as code.

Failures & limits

{
  "success": false,
  "message": "invalid license key",
  "code": "INVALID_KEY"
}

400 = malformed input, 403 = denied, 429 = rate-limited, 503 = unavailable. Inspect the JSON code even when HTTP is not 200. The limiter allows 60 auth requests per IP per minute per process; both exchange phases count, and a 429 includes Retry-After: 60.

See a request example or download the Postman collection.