HWID lock
A key binds to the first machine that runs it. Mismatches are refused and logged, and buyers can reset a binding from Discord.
Self-hosted · Your keys, your data
Whitelist & protection for Roblox Lua scripts
Key system, HWID locking and server-side script delivery in one API you deploy yourself. Your source never leaves your server, and every execution is logged.
loader.lua
-- MuseProtect loader (one line in your hub)
local resp = game:HttpGet(MUSE_URL)
local fn = loadstring(resp)
fn() -- payload is decrypted in-memoryEverything a hub needs
One system for keys, devices, delivery and logs — instead of gluing three services together.
Key system
Generate day-locked or lifetime keys in bulk, pause or expire them anytime, and export lists for your selling platform.
Source protection
Your Lua stays server-side and ships as an encrypted per-request payload. There is no static file to copy or share.
Anti-bypass signing
Every loader request carries an HMAC signature with a live timestamp — pasting the URL into a browser or curl simply fails.
Discord bot
Setup panel, buyer roles, key generation, HWID resets and a live log channel — your server becomes the admin panel.
REST API
Everything the bot does is available over HTTPS with a service token — build your own store, panel or automations on top.
Execution logs
Every run, HWID mismatch, expired key and blacklist hit is recorded with executor, game and IP — pushed to your Discord.
Rate limiting
Per-key request windows stop brute-force attempts and key-cracking tools before they get a second try.
Three steps to a protected script
No dashboard gymnastics — the flow is loader, keys, sell.
1
Store your payload
Register your script over the admin API. The source is stored server-side only — never as a public file.
2
Generate & sell keys
Create day-locked or lifetime keys in bulk. Sell them wherever you want; buyers redeem with one Discord command.
3
Buyers run the loader
The loader signs each request with your embedded secret. Valid requests get the payload; everything else gets logged.
loader flow
-- full request, signed per key
local url = API_BASE .. "/api/v1/script?script=main"
.. "&key=" .. KEY .. "&hwid=" .. HWID
.. "&ts=" .. (os.time() * 1000)
.. "&sig=" .. hmac_sha256(SECRET, payload)
local resp = game:HttpGet(url)
loadstring(resp)()Runs where your users run
Any executor with HttpGet and loadstring works — no SDK, no special build.
- Delta
- Codex
- Solara
- Wave
- Synapse Z
- Xeno
- Vega X
- Potassium
- Swift
- Real
- MacSploit
- Ronin
Pricing
Placeholder tiers — every paid feature set includes everything below it.
Free
For testing the waters
$0/forever
- 1 script
- 25 active keys
- HWID lock & signing
- Discord bot & API
Pro
For a hub with real customers
$5/month
- 5 scripts
- 1,000 active keys
- Bulk key generation
- Execution logs & stats
- Priority support
Enterprise
For large distributors
$20/month
- Unlimited scripts & keys
- Custom rate limits
- Dedicated support channel
- Custom integrations
Frequently asked
Can buyers see my source code?
No. Your Lua is stored server-side and delivered as an encrypted payload that only passes key, HWID and signature checks. For bytecode-level protection, run your payload through an obfuscator such as Luraph before storing it — MuseProtect handles access control either way.
How does HWID locking work?
The first run binds a key to the machine's hardware ID. Later runs from a different machine are refused and logged. If a buyer legitimately changes PC, they can reset the binding through your Discord bot — limited by a configurable number of resets per key.
Which executors are supported?
Any executor that provides HttpGet and loadstring — which is effectively all of them. The loader is a plain Luau file you embed; nothing is compiled per-executor.
Is this a hosted service?
Yes, this is a hosted service, a Lua protection and whitelisting system like Luarmor or PolSec.
How do buyers get their keys?
You sell wherever you like. Generate keys with /generate in Discord, hand them out on purchase, and buyers activate with /redeem — which verifies the key and assigns your buyer role automatically.