SECRET="c3499ac4ae2f5ca6715e9ee04cfe542aa5070593d6fa6341"
KEY="A13A-6D58-A93C-6AC7"
HWID="my-hwid"
NONCE="$(head -c16 /dev/urandom | xxd -p)"

SIG=$(printf '%s|%s|%s' "$NONCE" "$KEY" "$HWID" \
  | openssl dgst -sha1 -hmac "$SECRET" -hex | sed 's/^.*= //')

curl -s -X POST https://vampauth.com/api/v1/key/check \
  -H "Content-Type: application/json" \
  -d "{\"project_id\":\"2Q9V222NTI2WJ45N\",\"key\":\"$KEY\",\"hwid\":\"$HWID\",\"nonce\":\"$NONCE\",\"signature\":\"$SIG\"}"

import crypto from "node:crypto";

const PROJECT_ID = "2Q9V222NTI2WJ45N";
const AUTH_SECRET = "c3499ac4ae2f5ca6715e9ee04cfe542aa5070593d6fa6341";

const hmac = (...parts) =>
  crypto.createHmac("sha1", AUTH_SECRET).update(parts.join("|"), "utf8").digest("hex");

export async function checkKey(key, hwid) {
  const nonce = crypto.randomBytes(16).toString("hex");
  const res = await fetch("https://vampauth.com/api/v1/key/check", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      project_id: PROJECT_ID,
      key, hwid, nonce,
      signature: hmac(nonce, key, hwid),
    }),
  });
  const data = await res.json();
  if (!res.ok) throw new Error(`${data.error ?? res.status}: ${data.message ?? ""}`);

  const expiresUnix = data.expires_at
    ? Math.floor(Date.parse(data.expires_at) / 1000)
    : 0;
  const expected = hmac(data.nonce_echo, data.status, expiresUnix, data.project_id);
  const okSig = expected.length === data.signature.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(data.signature));
  if (data.nonce_echo !== nonce || !okSig) throw new Error("signature verification failed");

  return data; // { status, key, hwid_bound, expires_at, created_at, project_id }
}

local KEY, PROJECT_ID, SECRET = "A13A-6D58-A93C-6AC7", "2Q9V222NTI2WJ45N", authSecret
local HWID = game:GetService("RbxAnalyticsService"):GetClientId()
local NONCE = game:GetService("HttpService"):GenerateGUID(false)

local function hmacSha1Hex(secret, msg) ... end -- from the reference client, or your own

local body = HttpService:JSONEncode({
  project_id = PROJECT_ID, key = KEY, hwid = HWID, nonce = NONCE,
  signature = hmacSha1Hex(SECRET, NONCE .. "|" .. KEY .. "|" .. HWID),
})
local res = request({ Url = "https://vampauth.com/api/v1/key/check",
  Method = "POST", Headers = { ["Content-Type"] = "application/json" }, Body = body })
local data = HttpService:JSONDecode(res.Body)

local exp = 0
if data.expires_at then exp = isoToUnix(data.expires_at) end
local ok = data.nonce_echo == NONCE
  and hmacSha1Hex(SECRET, data.nonce_echo .. "|" .. data.status .. "|" .. exp .. "|" .. data.project_id) == data.signature
if not ok then return end -- fail closed
-- script body

local raw = storage_id
  .. "|" .. tostring(executor_install_id or "")
  .. "|" .. platform
  .. "|" .. tostring(math.floor(resolution_x))
local hwid = sha256(raw) -- the one opaque string you send