Quickstart

From zero to a validated key in five steps.

1. Create a project

Project ID — public, e.g. 2Q9V222NTI2WJ45N. Sent in every request.
Auth Secret — 48 hex chars. Signs requests, verifies responses. Treat it like a password; it ships only inside obfuscated scripts.

2. Embed the keycheck

Two ways to get a validated script: Vampauth SDK (no code) — upload your script in Scripts, link it to the project, and pick the default Vampauth SDK mode. Share the generated snippet:

getgenv().script_key = "PASTE-KEY-HERE"
loadstring(game:HttpGet("https://vampauth.com/api/projects/2Q9V222NTI2WJ45N/scripts/my-script"))()

The launcher validates the key before your code runs — obfuscation included automatically. Reference client — embed the check yourself:

local Vampauth = loadstring(game:HttpGet("https://vampauth.com/client/vampauth.lua"))()
local vp = Vampauth.new({ projectId = "2Q9V222NTI2WJ45N", authSecret = "c3499ac4ae2f..." })
local ok = vp:Check("A13A-6D58-A93C-6AC7")
if not ok then return end
-- script body

For testing only — production scripts embed the client and get obfuscated (step 5).

3. Configure checkpoints

Optional, for free/public projects: add checkpoints (third-party ad/offer links) under project settings. End users complete them before a key is issued. Set how many are required and the key duration.

4. Issue a key

Create one manually on the project page, or let the checkpoint flow generate keys. Keep an FFA (never-expires, unbound) key around for testing.

5. Validate — or just trust the client

Raw contract, if you’re building your own client:

NONCE=$(head -c16 /dev/urandom | xxd -p)
SIG=$(printf '%s|%s|%s' "$NONCE" "$KEY" "$HWID" \
  | openssl dgst -sha1 -hmac "$SECRET" -hex | sed 's/^.*= //')

curl -s -X POST https://vampauth.com/api/v1/key/check \
  -H "Content-Type: application/json" \
  -d "{\"project_id\":\"2Q9V222NTI2WJ45N\",\"key\":\"$KEY\",\"hwid\":\"$HWID\",\"nonce\":\"$NONCE\",\"signature\":\"$SIG\"}"

A 200 isn’t enough — verify the response signature before trusting it. The reference client does this for you and fails closed.

6. Protect the script

Embed the keycheck in the script source, then obfuscate with script protection or your own tool. The auth secret has no protection outside obfuscation — that’s the model.

Getting Started

Platform

REST API

Guides

Quickstart

Quickstart

1. Create a project

2. Embed the keycheck

3. Configure checkpoints

4. Issue a key

5. Validate — or just trust the client

6. Protect the script

​Quickstart

​1. Create a project

​2. Embed the keycheck

​3. Configure checkpoints

​4. Issue a key

​5. Validate — or just trust the client

​6. Protect the script

Quickstart

1. Create a project

2. Embed the keycheck

3. Configure checkpoints

4. Issue a key

5. Validate — or just trust the client

6. Protect the script