The snippet you get carries no script code: only your key. The real code lives on the loader and is handed over only if the key is valid for that device.
On payment we generate a unique key (SH-XXXX-XXXX-XXXX-XXXX) tied to your account and to that script.
On the first launch the loader sends your PC's hardware id: from then on the key only works there.
Every run goes through /api/v1/validate. Revoked key or a different HWID: the script won't start.
Switching machines? Release the HWID from your dashboard and the next launch binds the new device.
Called by the loader on every launch. It also accepts GET with the same parameters in the query string, for executors without a JSON helper.
Request
POST /api/v1/validate
Content-Type: application/json
{
"key": "SH-7K4M-QT2X-9RBD-HZ3W",
"hwid": "a41f9c0e-...-b7",
"script": "jujutsu-zero"
}Response
200 OK
{
"ok": true,
"script": "jujutsu-zero",
"name": "Jujutsu Zero",
"hwid_bound": true
}
403 Forbidden
{
"ok": false,
"code": "hwid_mismatch",
"error": "Key already bound to another device."
}| Code | Meaning |
|---|---|
| invalid_key | The key doesn't exist. |
| revoked | Key disabled by an administrator. |
| expired | Timed key expired (lifetime licenses never expire). |
| hwid_mismatch | Key already bound to another device. |
| wrong_script | The key belongs to a different script. |
Grab a script and get key + snippet in a few seconds.