Roblox key systems for Lua script whitelisting.
License your Roblox scripts. Let your AI client handle keys, loaders and providers through native MCP. Start on Free with your first project.
- Delta
- Codex
- Volt
- Solara
- Xeno
- Real
- Madium
- Nexomia
Lua auth, key systems and native MCP.
Native MCP management. Just ask.
Create projects, issue or revoke keys, reset HWIDs, publish loaders and inspect analytics from your AI client. Vampauth brings licensing operations into the tools where you already work.
Claude Code, Cursor and VS Code
Use the connection recipe from your dashboard, sign in through your browser and choose the projects and permissions the client can access.
Real actions, not copy-paste advice
Ask your connected client to issue a test key, reset a user's hardware binding or publish a loader. Authorized MCP tools make the changes in your workspace.
Your workspace. Your permissions.
Start read-only, grant management access when you need it and revoke a connection from the dashboard. Current project permissions and publishing allowances still apply.
Secure loaders. Control what you deliver.
A static payload URL hands over the same file. A managed loader can check access first and choose the payload for that key. Use double-layer Full VM protection for the payload and required generated stub, or Off/passthrough for plain or externally protected code. Enable the runtime controls your script needs.
Check access
With key checking enabled, validate the license and expiry before delivery. Add HWID binding and device bans when you need those controls.
Select the payload
Route Standard and Premium Key Groups to different payloads through one shared loader URL, with a project default for ungrouped keys.
Deliver the selected code
Authorized keyed runs receive a short-lived signed download link. Obfuscation transforms the payload; authorization decides who receives it. Turning key checking off makes retrieval public to holders of the URL.
Keep checking, if the run needs it
Optional session leases renew authorization while the script runs. Presence only reports activity. Neither a later ban nor a lease denial can retract code already delivered.
Device-bound script licensing.
Issue a license key, choose its expiry and enable HWID binding when access should belong to one device. Manage legitimate resets and key bans without losing the key's usage history.
Key expiry
Choose timed or lifetime access. Manual first-use timers can start on the first successful validation.
One device per bound key
Enabled HWID checks compare a client-supplied device ID with the saved binding. FFA keys bypass binding; optional fingerprint history is advisory evidence for support, not an identity gate.
Key bans and resets
Deny future authorization or clear a legitimate binding. Code already delivered cannot be retracted.
Checkpoint rewards through your own accounts.
Configure provider links and reward packages so users can earn keys. Server-side completion checks control issuance. Your ad network pays you directly; Vampauth takes no share of checkpoint earnings.
Provider configuration
Connect Linkvertise, LootLabs or Work.ink with the credentials, links and packages required by your provider.
Manual or earned keys
Issue a key directly for testing or private access, or let users complete your configured checkpoint flow.
Packages, renewal and more time
Pair checkpoint counts with key durations and optional Key Groups. An eligible expired key can renew; an eligible active checkpoint key can stack more time without issuing another key.
Lua/Luau publishing
Publish with Full VM payload protection or Off/passthrough for your own code protection. Required generated stubs also use Full VM. Enable the runtime components your script needs.
Sessions and concurrent runs
Enable leases for continuing authorization and limit simultaneous keyed runs. A run limit does not add device bindings; advisory presence is separate and database-backed.
Discord bot panels
Create a project panel with the main bot's /panel menu. Its stable loader selection follows URL rotation; repair or move the panel without recreating your users' keys.
Event-specific Discord webhooks
Subscribe to key, checkpoint or loader events and assign the relevant loader. Notifications are separate from bot panels; a preview is not a delivered message.
Licensing analytics
Compare checkpoint completions and failures, inspect lifetime key uses and resets, and review loader delivery or denial counters. Delivery does not prove successful game execution.
Scoped support teams
Let support read keys and reset HWIDs without granting key deletion, loader publishing or project settings. Teammates use their own accounts and independent permissions.
Key Groups and payload routing
Serve Standard and Premium editions from one distribution entry point. Map each group to its payload and check the ungrouped default before sharing.
Scoped AI connections
Connect a compatible AI client through Model Context Protocol (MCP) to manage projects, keys, loaders and providers. Connection scopes, current project permissions and resource allowances still apply; read-only actions do not activate keys.
Lua key-system plans: Free, Developer and Pro.
Free
default$0forever
Everything you need to issue keys and deliver your scripts.
Create your first project- 10 projects
- 10,000 licenses per project
- Checkpoint rewards from multiple providers
- Optional HWID binding, one device per bound key
- Script hosting and loadstrings
- Full VM payload protection or Off/passthrough
- 5 protected payload builds per week by default
- 20 account-level script slots
- Analytics, Discord bot and webhooks
Developer
subscription$5/month
Higher project capacity and 10 protected payload builds each week by default.
Subscribe on Discord- Everything in Free, plus
- 20 projects
- 20,000 licenses per project
- The same protection choices as every plan
- 10 protected payload builds per week by default
- 40 account-level script slots
Pro
subscription$15/month
15 protected payload builds each week by default, higher limits and custom flow URLs.
Subscribe on Discord- Everything in Free, plus
- 50 projects and 50,000 licenses per project
- The same protection choices as every plan
- 15 protected payload builds per week by default
- 100 account-level script slots
- Custom flow URLs
A new protected payload build uses one weekly allowance unit. Compatible unchanged builds, source-free URL rotations, metadata-only edits, passthrough payloads, downloads and executions use no protected-payload allowance. Failed publishing preserves the active build. Allowances reset Monday at 00:00 UTC. Key flows are ad-supported on every plan.
Roblox key systems, Lua auth and MCP.
What is Roblox script whitelisting?
Script whitelisting grants permission to run a Lua/Luau script. A key system can validate a license, check expiry and optionally bind access to one device. Vampauth manages these rules through projects, keys and configurable hosted loaders.
Can I manage my key system with AI through MCP?
Yes. Connect a compatible AI client through Model Context Protocol (MCP) to manage projects, keys, loaders and providers. Connection scopes, current project permissions and resource allowances still apply; read-only actions do not activate keys. Ask your connected client to create a project, issue or revoke keys, reset a hardware binding, publish a loader or inspect analytics. Authorized tools act on your workspace; you do not need to copy each change into the dashboard. Management actions require the relevant permissions and allowances.
Which AI clients can I connect to Vampauth MCP?
The dashboard includes connection recipes for Claude Code, Cursor and VS Code, plus a remote HTTP recipe for other compatible MCP clients. Open Dashboard → MCP, choose your client and complete browser sign-in and consent. Start with read-only access, choose the projects and permissions the connection may use, and revoke it from the dashboard whenever needed. A chat app must support remote MCP connections; a normal chat conversation alone does not connect it to your account.
Can I start a Roblox key system for free?
Free includes 10 projects, 10,000 licenses per project, 20 script slots and a default allowance of 5 new protected payload builds per week. Developer is $5/month and Pro is $15/month, available via Discord. Pro also includes custom flow URLs. Start by creating a project and issuing a manual test key; checkpoints are optional.
How does Lua authentication work with HWID binding?
With HWID checks enabled, a non-FFA license key binds to one device on successful use. An authorized reset clears its device binding while preserving key expiry and usage history. Keep key checking and HWID binding enabled for device-restricted access. FFA keys bypass binding; keyless delivery does not require a key.
How does script obfuscation work?
New protected builds use double-layer Full VM protection for the payload and generated loader stub when runtime components require one. An unobfuscated option (Off/passthrough) preserves submitted code, including code protected by your own obfuscator; a newly published stub still uses Full VM. New Light publishing is unavailable; existing historical payloads may remain deliverable or be reused by eligible source-free URL rotations. Disabling all runtime components serves the final payload directly without a stub or access checks. The same current protection choices are available on every plan. Default protected-payload allowance: 5 new builds/week on Free, 10 on Developer, 15 on Pro. Reset Monday 00:00 UTC. A new protected payload build uses one weekly allowance unit. Compatible unchanged builds, source-free URL rotations, metadata-only edits, passthrough payloads, downloads and executions use no protected-payload allowance. Failed publishing preserves the active build.
What loader protections does Vampauth provide?
Newly published loader stubs use Full VM obfuscation; Full also protects the payload, giving double-layer VM protection when a stub is required. Runtime guards default on for new modular loaders and detect specific context or function-environment tampering. Delivery uses HTTPS/TLS; authorized keyed runs receive signed download URLs lasting about 60 seconds. The public Lua obfuscator guide documents anti-dump measures, environment-hook detection scope and encrypted-delivery details. These are code protection, runtime checks and transport encryption respectively; client-side code is not guaranteed undumpable, and transport encryption is not a separate per-execution payload cipher.
Does Vampauth take a share of checkpoint earnings?
No. Creators use links from their own Linkvertise, LootLabs or Work.ink accounts and receive checkpoint earnings directly from those providers, subject to each provider's terms. Vampauth takes 0% of creators' checkpoint earnings. Vampauth earns separate advertising revenue from small banner ads displayed on its key-flow pages (flow URLs); these ads do not reduce creators' checkpoint payouts. Optional Developer and Pro subscriptions are separate from checkpoint earnings, and key-flow pages remain ad-supported on every plan.
What script files does Vampauth store?
Modern publishing retains the final payload and a generated loader stub when runtime components require one. It does not retain a separate original-source object. Off/passthrough output contains the submitted code, including any external obfuscation. Keep your original code locally for future replacements.
Where can I get integration help?
Use the official documentation for current loader and API contracts. Community support is available through the Vampauth Discord. Keep management tokens, provider credentials and signing secrets on your backend rather than in a distributed script.
Create your first licensing project.
Start with the Free plan. Register, create a project and issue a test key before connecting your loader and optional checkpoint rewards.