Private beta · invite only

Ship Roblox scripts that can't be stolen.

xauth puts a license server in front of your code. Every request is authenticated with a key, bound to one machine, and answered with an encrypted, runtime-keyed payload. A leaked file is just noise. The decrypt key never ships with it.

loader.lua paste into your script
-- one line. auth, decrypt, heartbeat and unload are handled for you.
local KEY = "your-license-key"
loadstring(game:HttpGet("https://xauth.live/loader/<project>"))(KEY)
AES-class
VM + runtime-key payloads
1 device
HWID lock per key
<1s
challenge to verified delivery
Live
heartbeat sessions + owner kick
Everything a whitelist needs

Protection that actually holds

Not a magic hash you can patch out. A real handshake, a real session, and a payload that's useless without the server.

Server-issued keys

Random, unguessable keys. Set expiry, device limits and notes per key. Ban or rotate instantly, and access dies on the next request.

HWID lock

A key binds to the first machine that uses it. Sharing a key just fails on the second device. Users can request a reset and you approve it.

Encrypted, runtime-keyed payloads

Your script is compiled to our VM and locked to a per-project runtime key the server only releases after auth. The file on disk decrypts to nothing.

Live sessions and heartbeat

Every run opens a short-lived session with a rolling token. Miss the heartbeat and it's gone. Kick any active user from the dashboard in one click.

Discord redemption

Buyers redeem a key through your Discord bot. Their identity attaches to the key, so you see who owns what right in the dashboard.

Tamper signals, not false bans

The loader reports environment anomalies and the server decides. Legit users never get bricked by a false positive. You just get the signal.

How it works

From key to running script

Four moving parts, one line for your users. Everything sensitive stays on the server.

1

Handshake

The loader asks for a challenge and proves the key with an HMAC. No key ever travels in the clear, and replays are rejected.

2

Bind and authorize

The server checks the key, locks the HWID, and mints a short-lived session token. Wrong key or wrong machine gets nothing back.

3

Staged delivery

Your payload is streamed in verified chunks, each hash-checked and wrapped so it only runs inside a live, authorized session.

4

Run and heartbeat

The script runs, sends heartbeats, and cleanly unloads when the session ends. No hangs, no leftover globals.

Drop-in

One line for your users

Upload your script once. xauth obfuscates it, binds it to a runtime key, and gives you a loader URL. Your users paste a single line and you control everything else from the dashboard.

-- keyless mode: no key, still VM-protected
loadstring(game:HttpGet("https://xauth.live/loader/<project>"))()

-- key mode: key + HWID + session
local KEY = "paste-key-here"
loadstring(game:HttpGet("https://xauth.live/loader/<project>"))(KEY)

-- that's the whole client.
Modes

Pick a mode per project

Every project you create runs one of three modes. Switch any time. The same protection applies to all of them.

Keyless

Open access, still VM-protected. Good for public tools.

  • Encrypted VM payload
  • Browser view blocked
  • One-line loader
Most used

Free-key

Whitelist your users with full key and HWID control.

  • Everything in Keyless
  • Keys + HWID lock
  • Live sessions and kick
  • Discord redemption

Paid-key

Control access to a script you sell on your own terms.

  • Everything in Free-key
  • Expiring keys
  • Per-buyer identity
  • Webhook telemetry
Invite only

Access is private right now.

xauth is in a closed beta. If you have an invite code, create your account and ship your first key in minutes.