​

Reference Client

​

What it does

local Vampauth = loadstring(game:HttpGet("https://vampauth.com/client/vampauth.lua"))()
local ok, data = Vampauth.new():Check("KEY-1234")
if ok then
  -- signature verified, nonce matched, not expired
  print("valid until", data.expires_at)
else
  warn("denied:", data)
end

• the request returned 2xx,
• nonce_echo matches the nonce this call sent,
• the response carries signature and project_id,
• the Ed25519 signature verifies over sha256(nonce|hwid|expiresAtUnix|project_id),
• and the key is not locally expired.

​

Configuration

​

Embed, then obfuscate

1. Embed the client inside your script (paste the module body, not a remote loadstring).
2. Embed your keycheck logic, project key, and public signing key in the same file.
3. Obfuscate the whole thing with script protection.

​

Threat model

• Fake responses — a malicious server or an injected HTTP hook cannot sign a response; only Vampauth holds the project’s signing private key.
• Replays — each call uses a fresh nonce, so a captured valid response no longer verifies on the next call.
• Edited responses — changing expires_at or key invalidates the signature.

• The user removing the check — a client executed locally can have the keycheck patched out. This is what obfuscation is for.
• Weak HWID fingerprints — HWID is passthrough; Vampauth only compares the string. The quality of the fingerprint is on you.

​

Source

​

See also

• key/check — the endpoint contract.
• Signature verification — the signed payload.
• Integration snippets — building your own client.