Luarmor API Documentation

https://docs.luarmor.net
Admin
Luarmor API Documentation provides comprehensive guides for customers and script developers on...
Tokens:22,602
Snippets:197
Trust Score:6.1
Update:4 months ago
Show doc for...
Tokens:
Raw
### Dynamic Documentation Query Example

Source: https://docs.luarmor.net/webhook-protection

Illustrates how to query the documentation dynamically by making an HTTP GET request to the page URL with an 'ask' query parameter. This is useful for retrieving specific information not explicitly found on the page.

```http
GET https://docs.luarmor.net/webhook-protection.md?ask=<question>
```

--------------------------------

### Query Documentation Dynamically

Source: https://docs.luarmor.net/docs-for-3rd-parties

Perform an HTTP GET request on the current page URL with the 'ask' query parameter to get dynamic answers to your questions. The question should be specific and self-contained.

```http
GET https://docs.luarmor.net/docs-for-3rd-parties.md?ask=<question>
```

--------------------------------

### Query Documentation via HTTP GET

Source: https://docs.luarmor.net/identifying-common-scams

Perform an HTTP GET request to query the documentation dynamically. Use the 'ask' query parameter with a specific, natural language question.

```http
GET https://docs.luarmor.net/identifying-common-scams.md?ask=<question>
```

--------------------------------

### Use LPH_NO_VIRTUALIZE with RenderStepped

Source: https://docs.luarmor.net/insane-optimization-tricks-and-lph-macro-usage

Example of using LPH_NO_VIRTUALIZE with RunService.RenderStepped. This ensures the connected function runs without virtualization.

```lua
RunService.RenderStepped( LPH_NO_VIRTUALIZE( function(s)
   -- regular function body
end ))
```

--------------------------------

### Query Documentation with 'ask' Parameter

Source: https://docs.luarmor.net/ad-system-rewards/anti-bypass-policy

Use this GET request to ask specific questions about the documentation. The response includes direct answers and source excerpts.

```http
GET https://docs.luarmor.net/ad-system-rewards/anti-bypass-policy.md?ask=<question>
```

--------------------------------

### Query Documentation via HTTP GET

Source: https://docs.luarmor.net/ad-system-rewards

Use this method to ask specific questions about the documentation. The response includes direct answers and relevant excerpts.

```http
GET https://docs.luarmor.net/ad-system-rewards.md?ask=<question>
```

--------------------------------

### Use LPH_NO_VIRTUALIZE for generating tracers

Source: https://docs.luarmor.net/insane-optimization-tricks-and-lph-macro-usage

This example shows how to use LPH_NO_VIRTUALIZE to create a function for generating tracers and connect it to the heartbeat event.

```lua
local generateTracers = LPH_NO_VIRTUALIZE( function(pos, pos2)
    -- function body
end )
heartbeat:Connect(generateTracers)
```

--------------------------------

### Query Documentation with Luarmor Agent

Source: https://docs.luarmor.net/docs

Perform an HTTP GET request to the current page URL with the 'ask' query parameter to query the documentation dynamically. The question should be specific and in natural language.

```http
GET https://docs.luarmor.net/docs.md?ask=<question>
```

--------------------------------

### Syntax error with LPH_NO_VIRTUALIZE

Source: https://docs.luarmor.net/insane-optimization-tricks-and-lph-macro-usage

This example demonstrates a syntax error when using LPH_NO_VIRTUALIZE incorrectly with hookmetamethod. The function literal must be passed directly.

```lua
LPH_NO_VIRTUALIZE( -- this is a syntax error
local old old = hookmetamethod(game, "__namecall", function(...) end)
)
```

--------------------------------

### Use LPH_NO_VIRTUALIZE with GC scan loop

Source: https://docs.luarmor.net/insane-optimization-tricks-and-lph-macro-usage

Example of using LPH_NO_VIRTUALIZE within a garbage collection scan loop to process tables efficiently.

```lua
LPH_NO_VIRTUALIZE(function()
   for i,v in pairs(getgc()) do 
       if type(v) == 'table' then
           f = v
       end
   end
end)()
```

--------------------------------

### GET /v3/keys/:api_key/details

Source: https://docs.luarmor.net/

Fetches detailed information about a specific API key, including associated project and script details.

```APIDOC
## GET /v3/keys/:api_key/details

### Description
Retrieve details for a given API key, such as project/script IDs, execution counts, and script names.

### Method
GET

### Endpoint
https://api.luarmor.net/v3/keys/:api_key/details

### Parameters
#### Path Parameters
- **api_key** (String) - Required - The API key for which to retrieve details.

### Response
#### Success Response (200)
- **success** (boolean) - Indicates if the request was successful.
- **message** (string) - A message indicating the result of the request.
- **email** (string) - The email associated with the API key.
- **discord_id** (string) - The Discord ID associated with the API key.
- **expires_at** (integer) - The timestamp when the API key expires.
- **registered_at** (integer) - The timestamp when the API key was registered.
- **plan** (string) - The subscription plan associated with the API key.
- **enabled** (integer) - Indicates if the API key is enabled (1 for enabled, 0 for disabled).
- **projects** (array) - A list of projects associated with the API key.
  - **platform** (string) - The platform of the project.
  - **id** (string) - The unique identifier for the project.
  - **name** (string) - The name of the project.
  - **settings** (object) - Project-specific settings.
  - **scripts** (array) - A list of scripts within the project.
    - **script_name** (string) - The name of the script.
    - **script_id** (string) - The unique identifier for the script.
    - **script_version** (string) - The version of the script.
    - **ffa** (boolean) - Indicates if the script is Free For All.
    - **silent** (boolean) - Indicates if the script runs silently.

#### Error Response (403)
- **success** (boolean) - Indicates if the request was successful.
- **message** (string) - A message indicating the error.

### Response Example (Success)
```json
{
    "success": true,
    "message": "Success!",
    "email": "federal@fbi.gov",
    "discord_id": "493827492379239857",
    "expires_at": 1674606328,
    "registered_at": 1672014328,
    "plan": "r",
    "enabled": 1,
    "projects": [
        {
            "platform": "roblox",
            "id": "2923c450865b60f65a5d06bb39ff1335",
            "name": "Alka-Seltzer Hub",
            "settings": {
                "reset_hwid_cooldown": -1
            },
            "scripts": [
                {
                    "script_name": "server crasher (free)",
                    "script_id": "ef67bc7f7bd0948f4fff336274a4a345",
                    "script_version": "0008",
                    "ffa": true,
                    "silent": false
                },
                {
                    "script_name": "premium one",
                    "script_id": "df3a1b7d79ceb911f8ffa762b0bd0596",
                    "script_version": "0000",
                    "ffa": false,
                    "silent": false
                }
            ]
        }
    ]
}
```

### Response Example (Error)
```json
{
    "success": false,
    "message": "Invalid API key! Visit https://luarmor.net/ to get access."
}
```
```

--------------------------------

### Incorrect usage of LPH_NO_VIRTUALIZE with function reference

Source: https://docs.luarmor.net/insane-optimization-tricks-and-lph-macro-usage

This is a bad example showing incorrect usage of LPH_NO_VIRTUALIZE by passing a function reference directly. LPH_NO_VIRTUALIZE expects a function literal or a function call that returns a function.

```lua
local function doSomething() 
   -- function body
end
LPH_NO_VIRTUALIZE(doSomething) -- you can't pass reference arguments
hookfunction(print, doSomething)
```

--------------------------------

### GET /v3/keys/:api_key/stats

Source: https://docs.luarmor.net/

Fetches statistical data for a given API key, including usage, obfuscations, and user limits.

```APIDOC
## GET /v3/keys/:api_key/stats

### Description
Fetch the statistics of your API key, including usage details, remaining obfuscations, maximum obfuscations, maximum users, and execution amounts.

### Method
GET

### Endpoint
https://api.luarmor.net/v3/keys/:api_key/stats

### Parameters
#### Path Parameters
- **api_key** (String) - Required - The API key for which to retrieve stats.

#### Query Parameters
- **noUsers** (Boolean) - Optional - If set to "true", it will return information about user limits (e.g., number of users, banned users, whitelisted users). This parameter can be omitted.

### Response
#### Success Response (200)
- **success** (boolean) - Indicates if the request was successful.
- **message** (string) - A message indicating the result of the request.
- **execution_data** (object) - Data related to execution frequency and history.
  - **frequency** (integer) - The frequency of executions in seconds.
  - **executions** (array) - An array representing historical execution counts.
- **stats** (object) - General statistics for the API key.
  - **obfuscations** (integer) - The number of obfuscations used.
  - **scripts** (integer) - The number of scripts associated with the key.
  - **users** (integer) - The number of users associated with the key.
  - **attacks_blocked** (integer) - The number of attacks blocked.
  - **default** (object) - Default limits for the plan.
    - **scripts** (integer) - Default maximum scripts.
    - **users** (integer) - Default maximum users.
    - **obfuscations** (integer) - Default maximum obfuscations.
  - **reset_at** (integer) - The timestamp when the stats reset.

### Response Example
```json
{
    "success": true,
    "message": "Success!",
    "execution_data": {
        "frequency": 86400,
        "executions": [
            5, 20, 0, 0, 0, 0, 0, 1900
        ]
    },
    "stats": {
        "obfuscations": 10,
        "scripts": 3,
        "users": 3,
        "attacks_blocked": 0,
        "default": {
            "scripts": 18,
            "users": 10000,
            "obfuscations": 3000
        },
        "reset_at": 1672014328
    }
}
```
```

--------------------------------

### Lua Error Handling with xpcall

Source: https://docs.luarmor.net/webhook-protection/useful-sample-scripts

This example demonstrates how to use xpcall to catch errors within a script and pass them to an error logger function. It is recommended to wrap all code, including spawned threads, with xpcall.

```lua
local function errorLogger(errorMsg)
   -- LRM_SEND_WEBHOOK(......)
end

xpcall(function()
   -- your entire code here.
   -- you must do this for all spawn()'ed threads as wells.

end, errorLogger)
```

--------------------------------

### Incorrect function call with LPH_NO_VIRTUALIZE

Source: https://docs.luarmor.net/insane-optimization-tricks-and-lph-macro-usage

This bad example shows a common mistake where the function wrapped by LPH_NO_VIRTUALIZE is not called. The wrapped function needs an additional `()` to be executed.

```lua
LPH_NO_VIRTUALIZE(function()
-- something
end) -- This part will not run because you are not calling it at the end.
-- You should add an extra () at the end in order to call it

print('done')
```

--------------------------------

### Get Users

Source: https://docs.luarmor.net/

Fetches a list of users associated with a project. Supports filtering by various parameters like Discord ID, user key, or identifier, and includes pagination options.

```APIDOC
## GET /v3/projects/:project_id/users

### Description
Fetches a list of users associated with a project. Supports filtering by various parameters like Discord ID, user key, or identifier, and includes pagination options.

### Method
GET

### Endpoint
`https://api.luarmor.net/v3/projects/:project_id/users`

### Parameters
#### Path Parameters
- **project_id** (String) - Required - ID of the project to fetch users from

#### Query Parameters
- **discord_id** (String) - Optional - Discord ID to get the connected user
- **user_key** (String) - Optional - Key to get the connected user
- **identifier** (String) - Optional - HWID to get the connected user
- **from** (Number) - Optional - Start offset of the results. Useful for paging users and not fetching all at once.
- **until** (Number) - Optional - Finish index of the results. Useful for limiting the results to a specific range between "from" and "until" parameters.
- **search** (String) - Optional - Useful for filtering results that contains the value of "search" anywhere in one of their "identifier", "user_key", "discord_id" or "note" properties.

#### Headers
- **Authorization** (String) - Required - API key

### Response
#### Success Response (200)
- **success** (Boolean) - Indicates if the operation was successful.
- **message** (String) - Message confirming the success.
- **users** (Array) - An array of user objects, each containing details like user_key, identifier, discord_id, status, etc.

#### Response Example
```json
{
    "success": true,
    "message": "Success!",
    "users": [
        {
            "user_key": "zZAaGyLhHiwCJHYewdRFmzBLKYCfJBek",
            "identifier": "hwid will be here if linked",
            "identifier_type": "HWID",
            "discord_id": "",
            "status": "active",
            "last_reset": 1672016017,
            "total_resets": 3,
            "auth_expire": -1,
            "banned": 0,
            "ban_reason": "",
            "ban_expire": 0,
            "unban_token": "",
            "total_executions": 10,
            "note": "",
            "ban_ip": ""
        },
        {
            "user_key": "ktwCSBSgmWtlTrignkPB3hglhqLyjqKm",
            "identifier": "",
            "identifier_type": "HWID",
            "discord_id": "4157951988959",
            "status": "reset",
            "last_reset": 1672038004,
            "total_resets": 0,
            "auth_expire": -1,
            "banned": 0,
            "ban_reason": "",
            "ban_expire": 0,
            "unban_token": "",
            "total_executions": 0,
            "note": "",
            "ban_ip": ""
        },
        {
            "user_key": "",
            "identifier": "",
            "identifier_type": "",
            "discord_id": "",
            "status": "banned",
            "last_reset": 0,
            "total_resets": 0,
            "auth_expire": 0,
            "banned": 1,
            "ban_reason": "Invalid signature",
            "ban_expire": 1672629163,
            "unban_token": "QvLJPYzdjBujMlkwembfPrwjIfpsnTkq",
            "total_executions": 0,
            "note": "",
            "ban_ip": "129.20.20.20"
        }
    ]
}
```

#### Error Response (403)
- **Forbidden** Invalid API key

#### Error Response (404)
- **Not Found** Project not found!
```

--------------------------------

### Making the External Key Check Request

Source: https://docs.luarmor.net/docs-for-3rd-parties/3rd-party-external-key-check-api

This code snippet demonstrates how to construct and send the GET request to the external key check API. It includes setting up the URL, generating a client nonce, calculating the external signature, and defining custom headers.

```javascript
const url2 = randomNode + 'external_check_key?by=' + app_name + '&key=' + keyToCheck;
let client_nonce = randomString(16);

let client_hwid = "0b4082374928374b2934792374-abcdef"
let extSignature = sha1Hash(client_nonce + secret_n1 + keyToCheck + secret_n2 + SERVER_TIME + secret_n3 + client_hwid);

console.log("Sending signature:", extSignature); // dont actually print in production

const customHeaders = {
    'Content-Type': 'application/json',
    'clienttime': SERVER_TIME,
    'externalsignature': extSignature,
    'clientnonce': client_nonce,
    'clienthwid': client_hwid,
    'executor-fingerprint': "0b4082374928374b2934792374-abcdef"
}
const response2 = await fetch(url2, {
    method: 'GET',
    headers: customHeaders
});

const json2 = await response2.json();
console.log('Response from GET:', json2);
// verifying the response authenticity
let server_nonce = json2.signature;
```

--------------------------------

### Get API Key Details

Source: https://docs.luarmor.net/

Fetches detailed information about a specific API key, including associated projects, scripts, and usage limits. Requires the API key to be included in the URL path.

```json
{
    "success": true,
    "message": "Success!",
    "email": "federal@fbi.gov",
    "discord_id": "493827492379239857",
    "expires_at": 1674606328,
    "registered_at": 1672014328,
    "plan": "r",
    "enabled": 1,
    "projects": [
        {
            "platform": "roblox",
            "id": "2923c450865b60f65a5d06bb39ff1335",
            "name": "Alka-Seltzer Hub",
            "settings": {
                "reset_hwid_cooldown": -1
            },
            "scripts": [
                {
                    "script_name": "server crasher (free)",
                    "script_id": "ef67bc7f7bd0948f4fff336274a4a345",
                    "script_version": "0008",
                    "ffa": true,
                    "silent": false
                },
                {
                    "script_name": "premium one",
                    "script_id": "df3a1b7d79ceb911f8ffa762b0bd0596",
                    "script_version": "0000",
                    "ffa": false,
                    "silent": false
                }
            ]
        }
    ]
}
```

```json
{
    "success": false,
    "message": "Invalid API key! Visit https://luarmor.net/ to get access."
}
```

```json
{
    "success": false,
    "message": "Wrong API key"
}
```

--------------------------------

### Avoid Unsanitized Webhook Content

Source: https://docs.luarmor.net/webhook-protection

This example demonstrates an unsafe practice of including unvalidated user data directly in webhook content. It is technically supported but strongly discouraged as users can manipulate these values. Always use LRM_SANITIZE for user-specified values.

```lua
LRM_SEND_WEBHOOK("https....", {
    content = "Rank is " .. userRank -- userRank is not validated.
});
```

--------------------------------

### Get API Status

Source: https://docs.luarmor.net/

Retrieves the current status and version information of the Luarmor API. This is a simple GET request to check if the API is operational.

```json
{
    "version": "v3",
    "active": true,
    "message": "API is up and working!",
    "warning": false,
    "warning_message": "No warning"
}
```

--------------------------------

### Initialize LPH_NO_VIRTUALIZE Macro

Source: https://docs.luarmor.net/insane-optimization-tricks-and-lph-macro-usage

This code snippet initializes the LPH_NO_VIRTUALIZE macro. It's important to include this at the top of your script to avoid issues with the original code.

```lua
loadstring( (
    function LPH_NO_VIRTUALIZE(f) return f end;
) )();
```

--------------------------------

### GET /status

Source: https://docs.luarmor.net/

Retrieves the current status and version information of the Luarmor API. This endpoint is useful for checking API availability.

```APIDOC
## GET /status

### Description
This endpoint returns the version information about the API, indicating its active status and any potential warnings.

### Method
GET

### Endpoint
https://api.luarmor.net/status

### Response
#### Success Response (200)
- **version** (string) - The API version.
- **active** (boolean) - Indicates if the API is active.
- **message** (string) - A status message.
- **warning** (boolean) - Indicates if there are any warnings.
- **warning_message** (string) - The warning message if any.

### Response Example
```json
{
    "version": "v3",
    "active": true,
    "message": "API is up and working!",
    "warning": false,
    "warning_message": "No warning"
}
```
```

--------------------------------

### Use LPH_NO_VIRTUALIZE with hookmetamethod __index

Source: https://docs.luarmor.net/insane-optimization-tricks-and-lph-macro-usage

Demonstrates using LPH_NO_VIRTUALIZE with hookmetamethod for the __index metamethod. This is useful for optimizing property lookups.

```lua
old = hookmetamethod(game, "__index", LPH_NO_VIRTUALIZE( function(t, k)
    -- regular function body
end ))
```

--------------------------------

### Fetch Server Info and Select Node (C++)

Source: https://docs.luarmor.net/docs-for-3rd-parties/3rd-party-external-key-check-api

Fetches server synchronization information, including server time and available nodes, from the Luarmor API using libcurl and nlohmann/json. It then randomly selects a node URL. Requires libcurl and nlohmann/json.

```cpp
#include <iostream>
#include <string>
#include <random>
#include <sstream>
#include <iomanip>
#include <vector>
#include <stdexcept>
#include <curl/curl.h>
#include <openssl/sha.h>
#include <nlohmann/json.hpp>

// convenience
using json = nlohmann::json;

const std::string secret_n1 = "asdfdg**********";
const std::string secret_n2 = "zxczxcv*********";
const std::string secret_n3 = "hjgh************";
const std::string app_name   = "minecraftdlc";  // provided by federal.
std::string keyToCheck = "BAfjuLxndwTvMBNiCyqMsXMaTcOqXpcr";

// a-z A-Z 0-9 x 16
std::string randomString() {
    const int length = 16;
    const std::string chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
    std::random_device rd;
    std::mt19937 generator(rd());
    std::uniform_int_distribution<> dist(0, chars.size() - 1);

    std::string result;
    for (int i = 0; i < length; ++i) {
        result.push_back(chars[dist(generator)]);
    }
    return result;
}

// sha1 lowercase
std::string sha1Hash(const std::string& data) {
    unsigned char hash[SHA_DIGEST_LENGTH];
    SHA1(reinterpret_cast<const unsigned char*>(data.c_str()), data.size(), hash);
    
    std::ostringstream oss;
    for (int i = 0; i < SHA_DIGEST_LENGTH; i++) {
        oss << std::hex << std::setw(2) << std::setfill('0') << static_cast<int>(hash[i]);
    }
    return oss.str();
}

int main() {
    try {
        const std::string url1 = "https://sdkapi-public.luarmor.net/sync";
        std::string response = httpGet(url1); // can use a cURL wrapper here.

        // get JSON response
        json json1 = json::parse(response);
        std::cout << "JSON Response:\n" << json1.dump(4) << std::endl;

        if (!json1.contains("st") || !json1.contains("nodes")) {
            throw std::runtime_error("JSON does not contain required keys.");
        }
        auto SERVER_TIME = json1["st"].get<std::string>();
        auto nodesArray = json1["nodes"].get<std::vector<std::string>>();

        if (nodesArray.empty()) {
            throw std::runtime_error("No nodes found in JSON response.");
        }
        std::random_device rd;
        std::mt19937 gen(rd()); 
        std::uniform_int_distribution<> distr(0, nodesArray.size() - 1);

```

--------------------------------

### Fetch Server Info and Select Random Node

Source: https://docs.luarmor.net/docs-for-3rd-parties/3rd-party-external-key-check-api

This C++ snippet demonstrates how to select a random node from a pre-defined array and print server time and the selected node. It's the first step in interacting with the API.

```cpp
std::string randomNode = nodesArray[distr(gen)];

        std::cout << "SERVER_TIME: " << SERVER_TIME << std::endl;
        std::cout << "Random node: " << randomNode << std::endl;
        
        // reset of the code will be given in the next step
```

--------------------------------

### Check Key

Source: https://docs.luarmor.net/luarmor-user-manual-and-f.a.q

Make a call to fetch key data using your script ID.

```lua
lib.check_key("JnX84B...Q1")
```

--------------------------------

### Successful User Key Creation Response

Source: https://docs.luarmor.net/

Indicates that a user key was successfully added to the project.

```json
{
    "success": true,
    "message": "Success!",
    "user_key": "awIUiHenZzfScOsqkXwGHyRAOsTTcPMR"
}
```

--------------------------------

### Creating a key / user

Source: https://docs.luarmor.net/

This endpoint generates a unique key for a user within a specified project. If no user details are provided, the key will be unassigned, allowing the user to claim it and automatically associate their HWID and Discord ID. Users with linked HWIDs can run scripts if they include the `script_key` in their loader script, unless FFA mode is enabled.

```APIDOC
## POST https://api.luarmor.net/v3/projects/:project_id/users

### Description
This endpoint will generate a key. If you don't specify the parameters, key will be 'unassigned' which means a user with the key can claim it and automatically assign their HWID / Discord ID to the key.
Users who have their HWIDs linked to the keys will be able to run the script. If they don't include `script_key` on top of their script, they will not be able to run the script as long as the FFA mode isn't on.

### Method
POST

### Endpoint
https://api.luarmor.net/v3/projects/:project_id/users

### Parameters
#### Path Parameters
- **project_id** (String) - Required - ID of the project that you want to add the user key to.

#### Headers
- **Authorization** (String) - Required - API key.

#### Request Body
- **identifier** (String) - Optional - Identifier of the user to whitelist. Could be a HWID.
- **auth_expire** (Int32) - Optional - Unix timestamp (seconds) of expiry date. If you don't provide this field, it will never expire. Read here for more info.
- **note** (String) - Optional - Custom note for client. This might make it easier to identify the user.
- **discord_id** (String) - Optional - Discord ID of the user. If not specified, user won't be able to resethwid on their own. They can still link their discord id to their key using Redeem button on the discord bot (if you configured the bot)
- **key_days** (Number) - Optional - Number of days a key will have once it has been activated by user. Read here for more info.

### Response
#### Success Response (200)
- **success** (Boolean) - Description
- **message** (String) - Description
- **user_key** (String) - Description

#### Response Example
```json
{
    "success": true,
    "message": "Success!",
    "user_key": "awIUiHenZzfScOsqkXwGHyRAOsTTcPMR"
}
```

#### Error Response (400)
- **success** (Boolean) - Description
- **message** (String) - Description

#### Response Example
```json
{
    "success": false,
    "message": "Discord ID already exist."
}
```
```

--------------------------------

### Get API Key Stats

Source: https://docs.luarmor.net/

Retrieves statistical data for an API key, including execution counts, obfuscation limits, and user statistics. The `noUsers` query parameter can be used to exclude user-specific data for a slightly faster response.

```json
{
    "success": true,
    "message": "Success!",
    "execution_data": {
        "frequency": 86400,
        "executions": [
            5, 20, 0, 0, 0, 0, 0, 1900
        ]
    },
    "stats": {
        "obfuscations": 10,
        "scripts": 3,
        "users": 3,
        "attacks_blocked": 0,
        "default": {
            "scripts": 18,
            "users": 10000,
            "obfuscations": 3000
        },
        "reset_at": 1672014328
    }
}
```

--------------------------------

### Handle Key Check Results and Load Script

Source: https://docs.luarmor.net/luarmor-user-manual-and-f.a.q

Implement custom logic based on the key check status. If the key is valid, you can display user information and then load the script using api.load_script(). For invalid or locked keys, provide user feedback or kick the player.

```lua
-- custom logic below:
if (status.code == "KEY_VALID") then

    -- fetch basic info about the key (only if KEY_VALID)
    ui:SetBanner("Welcome. Seconds left: " .. (status.data.auth_expire - os.time()))
    ui:UpdateTitle("Total executions: ", status.data.total_executions)
    
    print("Is key from ad system? " .. status.data.note == "Ad Reward" and "YES" or "NO")
    
    script_key = script_key or textLabel1.Text; -- SET THE KEY BEFORE LOADSTRINGING.
    
    api.load_script(); -- Executes the script, based on the script_id you put above.
    -- Alternatively, you can just put the loadstring you got from luarmor website.
    -- You must specify the script_key global either way.
    return
    
elseif (status.code == "KEY_HWID_LOCKED") then
    ui:Notify("Key linked to a different HWID. Please reset it using our bot")
    return
    
elseif (status.code == "KEY_INCORRECT") then
    ui:Notify("Key is wrong or deleted!")
    return    
else
    -- fallback to anything else e.g blacklisted, key empty/too short:
    player:Kick("Key check failed:" .. status.message .. " Code: " .. status.code)
end

-- You can see a full list of possible status codes and status messages below.
```

--------------------------------

### Run Function Before Obfuscation with LRM_INIT_SCRIPT

Source: https://docs.luarmor.net/luarmor-user-manual-and-f.a.q

Use LRM_INIT_SCRIPT to execute a function before your main obfuscated code. This is useful for setting up UI elements or performing initial checks. Note that code within this script is not obfuscated and can be viewed directly.

```lua
LRM_INIT_SCRIPT(function()
		local UI_lib = loadstring(.....)()
	
		local Completed = false;
		local enteredKey;

		UI_lib:AddTab({ 
			Title = "Enter a key", 
			Type = "InputBox", 
			OnClick = function(key) 
				enteredKey = key;
				Completed = true; -- Let it go
			end
		});

		UI_lib:Show()

	-- Pend / Block execution until key is entered.
		while not Completed do wait() end
		script_key = enteredKey

end)
```

--------------------------------

### External Key Check API Endpoints

Source: https://docs.luarmor.net/docs-for-3rd-parties/3rd-party-external-key-check-api

This section details the HTTP API endpoints for external key validation. It requires two GET requests and specific headers. The first request retrieves server time and endpoint information, while the second performs the actual key check. SHA1 signatures are crucial for ensuring data integrity.

```APIDOC
## External Key Check API Endpoints

### Description
This API allows 3rd party applications to check the validity of keys generated by the Luarmor Ad Reward system. It requires two GET requests and specific headers. The first request retrieves server time and endpoint information, while the second performs the actual key check. SHA1 signatures are crucial for ensuring data integrity.

### Method
GET

### Endpoint
`/api/external/key/check`

### Parameters
#### Query Parameters
- **key** (string) - Required - The key to validate.
- **hwid** (string) - Required - The hardware ID of the client.
- **signature** (string) - Required - The SHA1 signature of the request.

### Request Example
```json
{
  "key": "YOUR_KEY_HERE",
  "hwid": "YOUR_HWID_HERE",
  "signature": "YOUR_SHA1_SIGNATURE_HERE"
}
```

### Response
#### Success Response (200)
- **status** (string) - The status of the key (e.g., "valid", "banned", "expired", "hwid_locked").
- **message** (string) - A message providing more details about the key status.
- **signature** (string) - The SHA1 signature of the response.

#### Response Example
```json
{
  "status": "valid",
  "message": "Key is active and valid.",
  "signature": "RESPONSE_SHA1_SIGNATURE_HERE"
}
```

### Error Handling
- **400 Bad Request**: Invalid request parameters or missing required fields.
- **401 Unauthorized**: Invalid or missing API key/shared secret.
- **403 Forbidden**: Project not approved or insufficient permissions.
- **500 Internal Server Error**: Server-side error.
```

--------------------------------

### Fetch Users with Filters

Source: https://docs.luarmor.net/

Retrieves a list of users from a project, with options to filter by discord_id, user_key, identifier, or search terms. Supports pagination using 'from' and 'until' parameters. The response includes user status, ban information, and other details.

```json
{
    "success": true,
    "message": "Success!",
    "users": [
        {
            "user_key": "zZAaGyLhHiwCJHYewdRFmzBLKYCfJBek",
            "identifier": "hwid will be here if linked",
            "identifier_type": "HWID",
            "discord_id": "",
            "status": "active",
            "last_reset": 1672016017,
            "total_resets": 3,
            "auth_expire": -1,
            "banned": 0,
            "ban_reason": "",
            "ban_expire": 0,
            "unban_token": "",
            "total_executions": 10,
            "note": "",
            "ban_ip": ""
        },
        {
            "user_key": "ktwCSBSgmWtlTrignkPB3hglhqLyjqKm",
            "identifier": "",
            "identifier_type": "HWID",
            "discord_id": "4157951988959",
            "status": "reset",
            "last_reset": 1672038004,
            "total_resets": 0,
            "auth_expire": -1,
            "banned": 0,
            "ban_reason": "",
            "ban_expire": 0,
            "unban_token": "",
            "total_executions": 0,
            "note": "",
            "ban_ip": ""
        },
        {
            "user_key": "",
            "identifier": "",
            "identifier_type": "",
            "discord_id": "",
            "status": "banned",
            "last_reset": 0,
            "total_resets": 0,
            "auth_expire": 0,
            "banned": 1,
            "ban_reason": "Invalid signature",
            "ban_expire": 1672629163,
            "unban_token": "QvLJPYzdjBujMlkwembfPrwjIfpsnTkq",
            "total_executions": 0,
            "note": "",
            "ban_ip": "129.20.20.20"
        }
    ]
}
```

```json
{
    "success": false,
    "message": "Project not found!"
}
```

--------------------------------

### Load Script

Source: https://docs.luarmor.net/luarmor-user-manual-and-f.a.q

Load the script using the previously assigned script ID. Ensure the script_key global is set before loading.

```lua
lib.load_script();
```

--------------------------------

### Import and Initialize Luarmor Key Check Library

Source: https://docs.luarmor.net/luarmor-user-manual-and-f.a.q

Import the Luarmor SDK API and initialize it with your script ID. This library allows for custom key validation before the main script execution, providing more control over handling invalid or expired keys.

```lua
local api = loadstring(game:HttpGet("https://sdkapi-public.luarmor.net/library.lua"))()
--> Returns a table with methods that you can use.
-- You must initialize it with the script ID first.

-- Put your own script ID Below:
-- You can find it in your loadstring URL or projects tab.
api.script_id = "f42f3746fb3eb60f837d3673581c14a6"
```

--------------------------------

### Check Key Validity

Source: https://docs.luarmor.net/docs-for-3rd-parties/3rd-party-external-key-check-api

This snippet demonstrates how to check if a key is valid by comparing server signatures and status codes. It logs success or failure messages.

```javascript
let serverSignature = sha1Hash(client_nonce + secret_n3 + json2.code);
if (json2.code === "KEY_VALID") {
    if (serverSignature !== server_nonce) {
        console.log('Server signature verification failed - tampered');
        return;
    } else {
        console.log('Server signature verification OK!!!');
        console.log("KEY is valid.")
        
    }
} else {
    console.log("Key verification failed: " + json2.code + ". Message: " + json2.message)
}
```

--------------------------------

### Fetch Server Info and Select Node (NodeJS)

Source: https://docs.luarmor.net/docs-for-3rd-parties/3rd-party-external-key-check-api

Fetches server synchronization information, including server time and available nodes, from the Luarmor API. It then randomly selects a node URL for subsequent requests. Requires node-fetch and crypto modules.

```javascript
const fetch = require('node-fetch');
const crypto = require('crypto');

const secret_n1 = "asdfdg**********"
const secret_n2 = "zxczxcv*********";
const secret_n3 = "hjgh************";
// You will be given 3 "shared secrets" by the owner, in DMs.
// you'll use them in the SHA1 signature calc in next step.

const app_name = "minecraftdlc" // you will be given this too, by federal.

let keyToCheck = "BAfjuLxndwTvMBNiCyqMsXMaTcOqXpcr" // user-inputted

// random str gen a-z A-Z and 0-9 only. And fixed 16 char output.
function randomString() {
    const length = 16
    const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
    let result = '';
    for (let i = 0; i < length; i++) {
        result += chars.charAt(Math.floor(Math.random() * chars.length));
    }
    return result;
}

function sha1Hash(data) { // SHA1 with LOWERCASE HEX output
    return crypto.createHash('sha1').update(data).digest('hex');
}

async function main() {
    const url1 = 'https://sdkapi-public.luarmor.net/sync';
    try {
        const response1 = await fetch(url1);
        const json1 = await response1.json();
        console.log(json1)

        const SERVER_TIME = json1.st;
        const NODES = json1.nodes;
        
        let randomNode = NODES[Math.floor(Math.random() * NODES.length)];

        console.log('Random node:', randomNode); 
        // e.g https://us2-roblox-auth.luarmor.net/
        
        // rest of the code will be written in step 2.

```

--------------------------------

### Failed User Key Creation Response (Discord ID Exists)

Source: https://docs.luarmor.net/

Indicates that the provided Discord ID is already associated with an existing key.

```json
{
    "success": false,
    "message": "Discord ID already exist."
}
```

--------------------------------

### Create User Key

Source: https://docs.luarmor.net/

This endpoint generates a new key for a user. If no identifier or discord_id is provided, the key will be unassigned and can be claimed by the user. The key will be automatically assigned HWID/Discord ID upon first use or claim.

```bash
POST https://api.luarmor.net/v3/projects/:project_id/users
```

--------------------------------

### Send Detailed Execution Log

Source: https://docs.luarmor.net/webhook-protection/useful-sample-scripts

This script sends a detailed log of user execution to a webhook, including user identifiers, IP address, and country code. Ensure users are informed if such data is logged.

```lua
local function sendDetailedExecutionLog() 
    LRM_SEND_WEBHOOK( 
        "https://discord.com/api/webhooks/4382635989158629991/9LtiYbxWZUCfeKKlMhmO2K5k5CSvsBxPck8iFCeMNyY8XkBeaY_8-SHWWJosYFRqV00Q", 
        { 
            username = "Catkeeper", 
            embeds = { 
                { 
                    title = "User executed!", 
                    description = "🔑 **User details:** \n**Discord ID:** <@%DISCORD_ID%>
**Key:** ||`%USER_KEY%`||
**Note:** `%USER_NOTE%`", 
                    color = 0xFFFFFF, 
                    fields = { 
                        { 
                            name = "Account details:", 
                            value = "**Username:** `" .. 
                                LRM_SANITIZE(game:GetService("Players").LocalPlayer.Name, "[a-zA-Z0-9_]{2,60}") .. 
                                    "`\n**User ID:** `" .. 
                                        LRM_SANITIZE(game:GetService("Players").LocalPlayer.UserId, "[0-9]{2,35}") .. 
                                            "`", 
                            inline = false 
                        }, 
                        { 
                            name = "IP:", 
                            value = "%CLIENT_IP% :flag_%COUNTRY_CODE%:", 
                            inline = true 
                        } 
                    } 
                } 
            } 
        } 
    ) 
end
```

--------------------------------

### Using Server-Side Variables in Webhook Content

Source: https://docs.luarmor.net/webhook-protection

Demonstrates how to embed server-side variables like %CLIENT_IP% and %COUNTRY_CODE% within webhook content strings. These variables are replaced server-side and cannot be spoofed by the user.

```lua
LRM_SEND_WEBHOOK("https....", {
    content = "User ran!\nDetails: \nIP: `%CLIENT_IP%` :flag_%COUNTRY_CODE%:"
});
```

--------------------------------

### Send Game Join Notification

Source: https://docs.luarmor.net/webhook-protection/useful-sample-scripts

Use this script to send a webhook notification when a player joins a game. It includes the Job ID and a teleport script for the user.

```lua
local function sendJoinScript() 
    LRM_SEND_WEBHOOK( 
        "https://discord.com/api/webhooks/4382635989158629991/9LtiYbxWZUCfeKKlMhmO2K5k5CSvsBxPck8iFCeMNyY8XkBeaY_8-SHWWJosYFRqV00Q", 
        { 
            username = "Cat Joiner", 
            embeds = { 
                { 
                    title = "Join Script", 
                    description = "Sent by discord user: <@%DISCORD_ID%>", 
                    color = 0x00FF00, 
                    fields = { 
                        { 
                            name = "Job ID:", 
                            value = "```" .. LRM_SANITIZE(game.JobId, "[a-fA-F0-9\\-]{36}") .. "```", 
                            inline = false 
                        }, 
                        { 
                            name = "Join script:", 
                            value = "```lua\ngame:GetService('TeleportService'):TeleportToPlaceInstance(" .. 
                                LRM_SANITIZE(game.PlaceId, "[0-9]{4,22}") .. 
                                    ", '" .. 
                                        LRM_SANITIZE(game.JobId, "[a-fA-F0-9\\-]{36}") .. 
                                            "', game:GetService('Players').LocalPlayer)```", 
                            inline = false 
                        } 
                    } 
                } 
            } 
        } 
    ) 
end
```

--------------------------------

### Update Script

Source: https://docs.luarmor.net/

Updates an existing script for a given project and script ID. Allows for silent, FFA, and heartbeat mode configurations.

```json
{
    "script": "your_script_content_here",
    "silent": true,
    "ffa": false,
    "heartbeat": true,
    "lightning": false
}
```

--------------------------------

### Unblacklist User Key

Source: https://docs.luarmor.net/

Constructs the URL to unblacklist a user key using its unique unban token. This endpoint does not require strict API key authentication.

```url
https://api.luarmor.net/v3/projects/123456abcdef/users/unban?unban_token=Xpsy9wegDpA5XS
```

--------------------------------

### Blacklist Key

Source: https://docs.luarmor.net/

Blacklists a user key and its associated HWID. A reason for blacklisting can be provided, along with an optional expiry timestamp.

```APIDOC
## POST /v3/projects/:project_id/users/blacklist

### Description
Blacklists an existing key and the HWID linked to it.

### Method
POST

### Endpoint
`https://api.luarmor.net/v3/projects/:project_id/users/blacklist`

### Parameters
#### Path Parameters
- **project_id** (String) - Required - Project ID that contains the key

#### Headers
- **Authorization** (String) - Required - API Key

#### Request Body
- **user_key** (String) - Required - User key to blacklist.
- **ban_reason** (String) - Optional - Blacklist reason. Will be shown to user when executed
- **ban_expire** (Int32) - Optional - Exact unix timestamp of the ban expiry date. Leave -1 or undefined for infinite ban.

### Request Example
```json
{
  "user_key": "some_user_key",
  "ban_reason": "Cheating",
  "ban_expire": 1700000000
}
```

### Response
(No specific success response body is detailed in the source, but the operation is expected to succeed if no errors are returned.)
```

--------------------------------

### Calculate Response Signature

Source: https://docs.luarmor.net/docs-for-3rd-parties/3rd-party-external-key-check-api

This snippet shows how to calculate the response signature when the key is valid ('KEY_VALID'). It combines the client nonce, a specific secret, and the 'code' from the JSON response.

```javascript
// combine values in this order:
sha1Hash(
    client_nonce + secret_n3 + // s2mle100lesh420f + hjgh************
    json2.code // "KEY_VALID"
);

// example input to the hash function would be:
s2mle100lesh420fhjgh************KEY_VALID

SHA1 Output:

e9cd0cc2445374f5e0942f822892dca7e68df228 a.k.a response "signature"
```
Tokens:
Raw