VaultLua is the developer infrastructure platform for licensing, protecting and distributing Luau scripts. HWID binding, sessions, reward links, REST API and analytics — all in one command center.
No credit card required · Demo accounts available · Production-grade security
Trusted by creators powering the top Roblox communities
From licensing to live sessions, from API to analytics — VaultLua handles the entire lifecycle of a Roblox script product.
Server-side delivery keeps your source out of the browser. Clients receive only authorized payloads after license, HWID, and session validation.
Generate single or batch keys with durations from 1 day to lifetime. Revoke, ban, suspend, extend, shorten, transfer, or reset HWID at any time.
Privacy-conscious device binding with reset cooldowns, history, and administrator override. Collects only a non-reversible device identifier.
Real-time session tracking with heartbeats. Terminate any session, inspect device info, or kill all sessions for a user with one click.
Ad-gated reward flows with checkpoint progression, provider adapters, and server-authoritative completion. No frontend-trusted state, ever.
24h, 7d, 30d, 90d, or custom ranges. Track requests, sessions, keys, rewards, and conversion rates with daily series breakdowns.
Bearer-token API with granular permissions: projects, scripts, users, keys, analytics. JavaScript, TypeScript, Python, and Lua examples.
Auto-assign roles on key redemption, remove on revocation, optional ban sync. Modular adapter supports any bot framework.
Paste or upload your Luau source. Versions are immutable once published.
Enable HWID binding, set max sessions, define heartbeat behavior per script.
Generate single or batch keys. Choose duration, max sessions, notes.
Share keys directly, embed in your executor, or generate public reward links.
Watch live sessions, terminate bad actors, review analytics in real time.
The Supabase service-role key (or any equivalent privileged credential) is never shipped to the browser. Every privileged action is re-validated server-side. Reward completion, license expiration, HWID binding, role checks — all enforced by the server, never the frontend.
-- Client requests authorized script payload
local res = HttpRequest({
url = "https://xyz.446.xyz/api/v1/execute",
headers = {
["Authorization"] = "Bearer " .. key,
["X-HWID"] = deviceFingerprint()
}
})
-- Server validates, server responds
if res.ok then
loadstring(res.body)()
else
warn("License invalid:", res.error)
endStart free. Upgrade when your community grows. Cancel anytime.
For solo creators getting started
For established creators with active communities
For studios and large communities
Join the creators using VaultLua to protect, license, and distribute their Roblox scripts to millions of players.