Guide

Roblox key system for Lua auth and script whitelisting

Product informationSources dated October 2026 · Vampauth Team · Vampauth compatibility reviewed against the November 4, 2026 production release; competitor details retain their source dates.

A Roblox key system controls access to a script with license keys and optional device binding. Vampauth combines script whitelisting, protected loaders and checkpoint flows: issue keys yourself or let users earn them through your configured links. Start on Free and choose higher allowances when your project needs them. Your first step is to create a project for the script you want to license.

Protection choices on every plan

Double-layer Full VM protection for new protected payloads and required generated stubs. Off/passthrough supports plain or externally protected code. Runtime checks are configurable. Default protected-payload allowance: 5 new builds/week on Free, 10 on Developer, 15 on Pro. Reset Monday 00:00 UTC.

Native MCP management

Connect a compatible AI client through Model Context Protocol (MCP) to manage projects, keys, loaders and providers. Connection scopes, current project permissions and resource allowances still apply; read-only actions do not activate keys.

0% revenue cut — always

Checkpoint links point to your accounts. Vampauth never takes a share. Free at core, with optional higher-limit plans.

Set up a Lua key system for your Roblox script

1. Create your first project. Register or sign in, name the project and choose its licensing settings. Keep HWID binding enabled if each bound key should work on one device.
2. Issue a test key. Create it manually to test access. Checkpoints are optional; configure provider links and reward packages when users should earn keys.
3. Publish your payload. A payload is the Lua/Luau code delivered by the loader. Choose payload protection and runtime components, keeping key checking enabled for licensed access. Keep your source locally for future updates.
4. Test the dashboard-provided snippet. Verify a valid key, an expired or banned key, and a device mismatch when binding is enabled. Follow the current official integration docs rather than copying an older request format.

Follow the first-project guide for the setup sequence, choose an integration for the right client or backend workflow, and use the loader instructions to test your dashboard-provided snippet. These are existing documentation pages, not a separate downloadable whitelist script.

Key validation, HWID checks and hosted payload delivery

HWID-bound keys

With HWID checks enabled, a non-FFA license key binds to one device on successful use. An authorized reset clears its device binding while preserving key expiry and usage history.

Checkpoint monetization

Offer checkpoint rewards using Linkvertise, LootLabs or Work.ink links from your own accounts. Server-side verification controls key issuance. Your ad network pays you directly; Vampauth takes no share of those earnings.

Protected loaders and script auth

Enable key checks before payload delivery, with optional HWID binding and renewable session leases. Custom integrations can use the standalone key-check API. Management tokens belong on your backend, never in a distributed Lua script.

Publishing and payload delivery

New protected builds use double-layer Full VM protection for the payload and generated loader stub when runtime components require one. An unobfuscated option (Off/passthrough) preserves submitted code, including code protected by your own obfuscator; a newly published stub still uses Full VM. New Light publishing is unavailable; existing historical payloads may remain deliverable or be reused by eligible source-free URL rotations. Disabling all runtime components serves the final payload directly without a stub or access checks. The same current protection choices are available on every plan. Default protected-payload allowance: 5 new builds/week on Free, 10 on Developer, 15 on Pro. Reset Monday 00:00 UTC. A new protected payload build uses one weekly allowance unit. Compatible unchanged builds, source-free URL rotations, metadata-only edits, passthrough payloads, downloads and executions use no protected-payload allowance. Failed publishing preserves the active build.

Discord bot & webhooks

Use the main Discord bot for interactive project panels and key management. Separately, subscribe Discord webhooks to selected key, checkpoint and loader events; a delivery notification is not proof that every script line ran.

Free, with scale when you need it

How Vampauth compares to other key systems

Compare the workflow as well as price: key capacity, publish allowances, supported languages, checkpoint providers and migration effort all matter. Our comparisons identify their competitor-source dates; check each provider's current terms before choosing.

Script whitelisting and Lua auth: how access is checked

Developers use “keysystem,” “script auth” and “Lua auth” for related access-control workflows. For Roblox Luau, the practical question is which users may run a payload, on which device, and for how long. Whitelisting here means granting script access; it is different from an email allowlist or a general website login system. A Lua whitelist system decides who has access; script authentication checks a credential; licensing adds rules such as expiry and revocation. An obfuscator changes code representation, which is a separate control.

For a Roblox auth system built around keys, decide whether you need device restrictions, timed access, manual licensing or checkpoint rewards. Read the HWID authentication guide for binding rules and the Lua/Luau publishing guide for protection profiles and delivery choices.

A secure loader connects enabled authorization checks to payload selection, controlled delivery and optional session renewal. Use the managed-loader workflow and its harmless allowed/denied test recipe before distribution.

Connect Linkvertise, LootLabs or Work.ink checkpoints

Checkpoint links let users earn a key instead of receiving one manually. Configure your provider credentials, links, reward packages and enabled state in the project. Check readiness and complete a test return to the originating flow before sharing it. The provider pays earnings to your own account; Vampauth does not take a revenue share. The provider setup guide covers the configuration steps.

Offer packages, then renew or stack access

For example, offer two checkpoints for 24 hours or four for 48 hours, within your project's effective limit. Each package pairs a count with a duration and can assign new keys to a Key Group. Ordered provider links cycle if a package needs more steps than there are links.

Renewal lets the original browser session complete a fresh flow for an eligible expired key, preserving the key and binding. Stacking repeats an eligible active checkpoint key's original available package and adds its current duration without issuing a second key. Lifetime, manual/origin-less, expired and banned/revoked keys cannot stack. These browser actions require the owning session and a fresh captcha; possession of a copied key alone is not enough. Follow the package, renewal and stacking guide for eligibility and cooldowns.

Standard and Premium keys, one loader entry point

Key Groups choose content, rather than teammate permissions. Create Standard and Premium groups in one project, connect each to its own payload loader from that project, and assign the corresponding keys. Share one keyed loader URL; the accepted key determines which group payload it receives.

Standard key → standard payload: For the standard edition or a checkpoint package mapped to Standard.
Premium key → premium payload: For a key you explicitly assign to Premium. The group name does not take payment or upgrade a customer automatically.
Ungrouped key → project default, or entry payload: If no override is configured, the entry loader's own payload is used. A configured override that is unavailable or invalid can deny delivery instead of silently substituting content. Test ungrouped access deliberately; deleting a group leaves its keys ungrouped and detaches package mappings.

These are illustrative edition names, not subscription entitlements. Keyless delivery uses the entry payload, not keyed group routing. Follow Key Groups and default-payload setup and verify all three paths before sharing.

Give support reset access, not owner credentials

Invite a support teammate with view_keys and reset_hwids so they can inspect a key and resolve a legitimate device change. Leave delete_keys, manage_loaders and edit_settings off if those tasks are outside their role. Key editing, group management, checkpoints and Discord settings have independent permissions; team management itself is owner-only.

Teammates use their own accounts. API/MCP scopes cannot expand their current project permissions, and removal applies on the next request. Read the team permission reference before delegating.

Publish a Discord panel for your project

Link your Discord account, then use the main Vampauth bot's /panel menu: Create panel → project → connected loader → channel → preview → publish. Setup requires project ownership and Discord Manage Server, plus the bot's channel permissions. The utility moderation bot is a separate application.

A panel selects a stable loader ID, so rotating its URL does not require recreating the panel. Use Refresh / repair for the existing message or Move to channel to relocate it. If the loader is deleted or disconnected, explicitly choose a replacement; the bot does not silently substitute one. Deleting a panel does not delete saved project keys. Follow the panel setup and repair instructions.

Ask the right question of each analytics metric

Are checkpoint flows completing?: Compare checkpoint completions and failures in the same UTC window. Management windows include the start and exclude the end; only checkpoint events use those date filters.
Does this key need support?: Inspect lifetime activations, uses and HWID resets, then the key's current state. Those totals can include standalone checks and other loaders; they are not windowed per-loader execution history.
Is delivery being accepted or denied?: Review loader delivery/denial counters from their deployment baseline. Timestamped delivery history is not retained and windowed delivery totals are unavailable; a delivered payload does not prove completed execution.
Which runs are recently active?: Advisory presence and active leases are unexpired database records shared across workers and app restarts. Neither is an exact user count; do not add them as unique users. Missing permission can make an analytics domain null, not zero.

Use authorized API/MCP reads for these questions, or inspect available dashboard views. See analytics definitions and the advisory fingerprint support example.

Send selected events to the right Discord channel

Webhooks send notifications; bot panels handle interactive access workflows. For a support channel, subscribe to hwid.reset and loader.denied, then assign the relevant loader for loader-context events. A webhook with no loader assignment receives no loader-context events; key changes and checkpoint completions without loader context remain project-wide. Up to five webhooks can be configured per project.

Current local v2 contracts and native MCP expose scoped list/create/update/delete, branding, test, delivery-status and operation-recovery actions. Use webhooks:read or webhooks:write and owner or manage_discord permission. Read the project revision before a write and preserve the operation UUID and identical inputs on recovery; check an unknown operation before starting another. Confirm the target environment exposes the action before automation.

URLs/secrets are write-only. Connecting or branding can change the real Discord webhook; tests send real messages. Preview is illustrative, and delivery status observes the current process since restart, not durable delivery history. High-frequency events can be throttled or aggregated; message counts are not execution totals. These are Discord embeds, not generic signed JSON event delivery. Read webhook events and loader assignment and the MCP scopes and recovery guide.

Give a Pro project a readable flow URL

For example, a Pro project could claim /my-script/flow if the name is available. This is a readable path on Vampauth, not a custom domain. The original project-ID URL still works. Pro expiry pauses the custom link while reserving its name; renaming releases the old name without redirecting it to the former project. See flow URL settings and lifecycle.

MCP management for your project workflows

Use the public MCP setup guide for Claude Code, Cursor and VS Code recipes, browser authorization and a read-only first request.

V2 adds project teams with scoped permissions and Key Groups for routing groups to different payloads. Keep management credentials server-side and use the documented loader or key-check integration for your client. Read the integration choices and credential guide, the v2 release notes, our HWID guide and the Free allowances and current pricing before migrating.

Inspect checkpoint completions and failures, lifetime key usage and HWID resets, loader delivery/denial counters and active-session observations through the API and MCP. Lifetime and deployment-baseline counters are not date-filtered delivery history; delivery is not proof of completed execution. Existing account holders can connect an MCP client from the dashboard.

Create your first Roblox licensing project

Start with a Free account, create a project and issue a manual test key. Add a payload and optional checkpoints after the project is ready.

Create your first project Sign in

Roblox key system — FAQ

What is a Roblox key system?

A Roblox key system manages license keys that control who can run a Lua/Luau script. Developers issue keys manually or let users earn them through configured checkpoints. Vampauth combines licensing with hosted loaders; enable key checking and HWID binding for device-bound access, or deliberately choose keyless delivery.

How much does a Roblox key system cost?

How many keys can I have on a free key system?

Free includes 10 projects, 10,000 licenses per project, 20 script slots and a default allowance of 5 new protected payload builds per week. Developer is $5/month and Pro is $15/month, available via Discord. Pro also includes custom flow URLs. License capacity, script slots and protected-payload builds are separate allowances. See Pricing for the full comparison.

Do key systems support HWID binding?

With HWID checks enabled, a non-FFA license key binds to one device on successful use. An authorized reset clears its device binding while preserving key expiry and usage history.

Does a key system take a cut of my ad revenue?

Vampauth takes no share of checkpoint earnings. You configure links from your own ad-network accounts, and the network pays you directly. Developer and Pro are optional subscriptions, separate from ad-network revenue.

How are my loader and payload protected?

Do I have to use keys at all?

No. A project can use keyless access, and a modular loader can disable key checking. An FFA key also bypasses device binding. Choose these deliberately: anyone with a direct-delivery URL can retrieve its final payload when all runtime features are off.

Is Roblox script whitelisting the same as Lua authentication?

In this workflow, script whitelisting means granting permission to run a script. Lua authentication or script auth validates a supplied key; licensing adds expiry, device policy and revocation. These are related script-access tasks, rather than a general website login system or a Roblox player allowlist.