POST /api/run

Send raw Roblox Luau source and receive JSON containing protected code. This endpoint does not stream its response.

Request

cURL · POSIX shell

curl --request POST \
  'https://obf.antilua.xyz/api/run?intenseVM=true&fastRuntime=false' \
  --header "Authorization: Bearer $ANTILUA_API_KEY" \
  --header 'Content-Type: text/plain' \
  --data-binary @script.luau

JavaScript

Node.js · ES module

import { readFile, writeFile } from 'node:fs/promises';

const source = await readFile('script.luau', 'utf8');
const response = await fetch(
  'https://obf.antilua.xyz/api/run?intenseVM=true&fastRuntime=false',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.ANTILUA_API_KEY}`,
      'Content-Type': 'text/plain',
    },
    body: source,
  },
);
const text = await response.text();
let result;
try { result = JSON.parse(text); }
catch { throw new Error(`HTTP ${response.status}: non-JSON response`); }
if (!response.ok || result.status !== true) {
  throw new Error(`HTTP ${response.status}: ${result.error ?? 'Request failed'}`);
}
await writeFile('script.protected.luau', result.code, 'utf8');

Python

This example uses the requests package. The client timeout is a local example setting, not a server build-time guarantee.

Python

import os
from pathlib import Path
import requests

response = requests.post(
    "https://obf.antilua.xyz/api/run",
    params={"intenseVM": "true", "fastRuntime": "false"},
    headers={
        "Authorization": f"Bearer {os.environ['ANTILUA_API_KEY']}",
        "Content-Type": "text/plain; charset=utf-8",
    },
    data=Path("script.luau").read_bytes(),
    timeout=300,
)
result = response.json()
if not response.ok or result.get("status") is not True:
    raise RuntimeError(f"HTTP {response.status_code}: {result.get('error')}")
Path("script.protected.luau").write_text(result["code"], encoding="utf-8")

Query parameters

map

Default: true
Behavior: Enables anti-tamper checks.

intenseVM

Default: true
Behavior: Enables Intense VM Structure: double obfuscation, source string protection and function proxification.

fastRuntime

Default: false
Behavior: Enables Fast runtime, source string protection and function proxification. Does not enable double obfuscation by itself.

Parameter	Default	Behavior
`map`	`true`	Enables anti-tamper checks.
`intenseVM`	`true`	Enables Intense VM Structure: double obfuscation, source string protection and function proxification.
`fastRuntime`	`false`	Enables Fast runtime, source string protection and function proxification. Does not enable double obfuscation by itself.

Use exact lowercase true or false values. The defaults are map=true, intenseVM=true and fastRuntime=false. See Protection options before combining both main controls.

Successful response

Illustrative values only; the API returns the current usage and timing for the request.

HTTP 200 · application/json

{
  "status": true,
  "code": "...protected Luau source...",
  "taken": 1234,
  "cached": false,
  "credits": 4,
  "limit": 5,
  "cooldownRemaining": 90000,
  "resetAt": "2026-11-01T00:00:00.000Z"
}

status

Meaning: true on success.

code

Meaning: Generated Luau source. Save this string as the output file.

taken

Meaning: Reported processing time in milliseconds.

cached

Meaning: false; this response is not served from a build cache.

credits / limit

Meaning: Remaining API requests and the effective API allowance.

cooldownRemaining

Meaning: Success cooldown duration in milliseconds.

resetAt

Meaning: The key’s next usage reset timestamp.

Field	Meaning
`status`	true on success.
`code`	Generated Luau source. Save this string as the output file.
`taken`	Reported processing time in milliseconds.
`cached`	false; this response is not served from a build cache.
`credits / limit`	Remaining API requests and the effective API allowance.
`cooldownRemaining`	Success cooldown duration in milliseconds.
`resetAt`	The key’s next usage reset timestamp.

Failures

Check the HTTP status before consuming code. A failed request returns status=false and an error when the application can provide JSON. See the error reference for retry guidance.