xauth puts a license server in front of your code. Every request is authenticated with a key, bound to one machine, and answered with an encrypted, runtime-keyed payload. A leaked file is just noise. The decrypt key never ships with it.
-- one line. auth, decrypt, heartbeat and unload are handled for you. local KEY = "your-license-key" loadstring(game:HttpGet("https://xauth.live/loader/<project>"))(KEY)
Not a magic hash you can patch out. A real handshake, a real session, and a payload that's useless without the server.
Random, unguessable keys. Set expiry, device limits and notes per key. Ban or rotate instantly, and access dies on the next request.
A key binds to the first machine that uses it. Sharing a key just fails on the second device. Users can request a reset and you approve it.
Your script is compiled to our VM and locked to a per-project runtime key the server only releases after auth. The file on disk decrypts to nothing.
Every run opens a short-lived session with a rolling token. Miss the heartbeat and it's gone. Kick any active user from the dashboard in one click.
Buyers redeem a key through your Discord bot. Their identity attaches to the key, so you see who owns what right in the dashboard.
The loader reports environment anomalies and the server decides. Legit users never get bricked by a false positive. You just get the signal.
Four moving parts, one line for your users. Everything sensitive stays on the server.
The loader asks for a challenge and proves the key with an HMAC. No key ever travels in the clear, and replays are rejected.
The server checks the key, locks the HWID, and mints a short-lived session token. Wrong key or wrong machine gets nothing back.
Your payload is streamed in verified chunks, each hash-checked and wrapped so it only runs inside a live, authorized session.
The script runs, sends heartbeats, and cleanly unloads when the session ends. No hangs, no leftover globals.
Upload your script once. xauth obfuscates it, binds it to a runtime key, and gives you a loader URL. Your users paste a single line and you control everything else from the dashboard.
-- keyless mode: no key, still VM-protected loadstring(game:HttpGet("https://xauth.live/loader/<project>"))() -- key mode: key + HWID + session local KEY = "paste-key-here" loadstring(game:HttpGet("https://xauth.live/loader/<project>"))(KEY) -- that's the whole client.
Every project you create runs one of three modes. Switch any time. The same protection applies to all of them.
Open access, still VM-protected. Good for public tools.
Whitelist your users with full key and HWID control.
Control access to a script you sell on your own terms.
xauth is in a closed beta. If you have an invite code, create your account and ship your first key in minutes.