Upload your source
Drag the raw Lua into the dashboard, or hit the API from CI. We obfuscate, embed the whitelist and hand back a build id. Your source is shredded after build unless you opt into the encrypted vault.
Spider Hub is the whitelist, licensing and revenue layer for Lua & Luau script developers. Upload your source once — we embed hardware-locked auth, obfuscate it, and hand you a dashboard, Discord bot, key API and kill switch that never blinks during a launch day.
Numbers below are pulled from the same metrics page the dashboard exposes to every account — not a marketing screenshot.
* Aggregated across all tenants since November 2024. Reward revenue is developer-earned, not ours.
Auth failures don't just annoy users — they kill a launch day, refund a month of sales and leak your hub to the free-rip channels. So we built the control plane the way SRE teams build payment systems: everything stateless at the edge, everything replicated, nothing that can hang your loader.
Every check terminates at the closest point of presence and is answered from a replicated read replica. No region is authoritative for your users.
Tokens are signed and verifiable on their own, so a packet loss, a cold node or a rolling deploy produces the exact same answer: 0.000% auth error rate over 12 months.
Set 15 minutes or 72 hours. If a player loses connection mid-session, the loader keeps running instead of kicking them — then silently re-syncs.
Rotate signing keys with a dual-active overlap. Nothing you shipped last year ever stops validating.
You do not change your script architecture, your executor targets or your sales flow. You replace one line — everything else is policy you configure from the dashboard.
Drag the raw Lua into the dashboard, or hit the API from CI. We obfuscate, embed the whitelist and hand back a build id. Your source is shredded after build unless you opt into the encrypted vault.
Ship a short loader that resolves the build, verifies the key and calls back into your code. It is under 300 bytes and safe to make public — there is nothing inside it to reverse.
Stock keys for Sellix / Share.Online, let the Discord bot redeem them, watch webhooks fire, and use the kill switch if a build leaks. Update code without asking anyone to redownload.
-- everything a script author has to write, forever
local Spider Hub = loadstring(game:HttpGet("https://cdn.spiderhub.xyz/loader/v3"))
Spider Hub:init({
scriptId = "8f2a-91c0-nova-hub",
hwid = true, -- bind device + executor
grace = 3600, -- seconds of offline play
onFail = function (reason, detail)
if reason == "KEY_EXPIRED" then
return ui:renewPrompt(detail.renewUrl) -- no kick, no crash
end
return ui:notice(reason)
end,
vars = { "tier", "note", "expires", "groupRank" }
})
Spider Hub:run(function ()
if LS.vars.tier == "premium" then enableModule("autoRaid") end
end)curl -sS -X POST https://api.spiderhub.xyz/v3/verify \
-H "Authorization: Bearer lsk_live_9c1f…" \
-H "Content-Type: application/json" \
-d '{
"script": "8f2a-91c0-nova-hub",
"build": "latest",
"key": "NOVA-7Q2P-XK19-M4AZ",
"hwid": "b41f…9ac2",
"fp": { "executor": "Delta", "arch": "arm64", "session": 12 },
"tamper": "sha256:0f91…c3d7"
}'
# → 200 {"status":"SUCCESS","ttl":3600,"vars":{...}}
# → 403 {"status":"HWID_LOCKED","remedy":{"action":"reset_link"}}import { Spider Hub } from "@spiderhub/sdk";
const ls = new Spider Hub(process.env.LS_KEY);
// stock 500 day-locked keys straight into your shop
const keys = await ls.keys.create({
script: "8f2a-91c0-nova-hub",
count: 500, durationDays: 30,
prefix: "NOVA", bind: "hwid",
webhook: "https://discord.com/api/webhooks/…",
});
await fs.writeFile("stock.txt", keys.map(k => k.code).join("\n"));
// verify before you ever ship the payload
const res = await ls.verify({ key, hwid, script });
if (!res.ok) reseller.refund(res.status); // EXPIRED | HWID_LOCKED | KILLED-- the managed bot is already in your Discord. Commands:
/key redeem NOVA-7Q2P-XK19-M4AZ → binds your HWID, DMs the loader
/key status → 27d left · premium · 1 device
/key reset → 3 self-service resets / 30d
/invite verify → grants role on successful redeem
/ticket open "exec threw 403" → posts build + fp hash to your staff
-- no bot? mount your own site with the same OAuth-less endpoints:
GET https://auth.spiderhub.xyz/nova-hub/redeem?ctx=%7B…%7DThe build happens in an ephemeral sandbox; the plaintext is shredded the moment obfuscation completes. What we keep is a hash of your source, the build manifest and the metadata your policy needs. If you enable Verified, a human reviewer sees anonymised code and it is deleted within the hour.
Fourteen systems that would otherwise be a Discord ticket queue, a PHP folder on a shared VPS and three pastebin scripts. Included in every paid plan.
Redeem, check status, reset HWID, open tickets and receive role grants — inside your server, no site login for the average user. Bring your own bot token or use ours; every action is mirrored to the same audit log your staff sees on the web.
Generate 5 or 50,000 keys with day-lock, lifetime or usage caps, prefix them for your brand, then export CSV / TXT straight into Sellix, Share.Online or a Google Sheet. Duplicate protection and per-batch limits included.
Per-key data your code can read — Discord ID, note, expiry, plan tier, arbitrary JSON — so you branch for a single user, an affiliate or a beta group without shipping a second build.
Disable a build, a script, a tier or a single leaked key. Scope it to a version range so old buyers keep working while the leaked build dies. Every execution after that returns your custom message.
Opt in and every build is sealed with your own passphrase and stored, so losing your laptop is a bad afternoon rather than a lost product. Roll any script back to a previous build in one click.
Monetise free users with Linkvertise, LootLabs, AdMaven or your own shorteners. Server-side completion proof means no fake passes, and we take 0% of what you earn.
Integrity hash on the payload, emulator/clone detection, session binding, VM and proxy scoring. Suspicious executions are served a decoy build instead of an error, so leakers learn nothing from probing.
Every redeem, reset, refund request, kill switch flip and blocked execution hits Discord or your endpoint with the full actor chain. Searchable for 90 days, exportable forever.
The whitelist is embedded at build time with a Luraph-class VM pass — no wrapper file, no hand-written auth block, and nothing for a buyer to strip out by deleting the top ten lines.
Give staff read-only access, let a reseller mint keys for one script only, and require 2FA on anything destructive. Every action is attributed — no shared logins at 3am.
DAU by script, executions by executor and country, churn on day-locked keys, revenue per affiliate and the top 10 failed-status reasons — with a CSV export for your accountant.
Issue a prefixed batch to each reseller or affiliate, then see exactly whose keys are running, whose are refunding and who is leaking. Payout percentages and per-seller caps are enforced at verification time, not by trust.
Self-service reset links, a copyable diagnostic bundle, status page per script and canned replies. Your ticket volume drops because 90% of "the key is broken" is a stale HWID.
Volunteer your source for a human review and earn a Verified badge buyers can filter on. Reviewers see anonymised code, and it is deleted within the hour. Once enabled it cannot be switched off — that is the point.
Pick a scenario and watch each verification stage resolve in the order your users hit it — the same response shape, error codes and remedies the real API returns. No signup, no rate limit.
Rolling your own auth gives you a maintenance burden you never budgeted for. A legacy whitelist gives you a shared, single-region key server and a changelog nobody reads. Numbers are p50 over a 30-day window.
| Capability | DIY PHP + pastebin | Legacy whitelist | Spider Hub |
|---|---|---|---|
| Median auth latency | 340 ms (1 region) | 182 ms | 11 ms · 41 regions |
| Auth error rate | depends on your hosting | 0.8–2.4% on launch day | 0.000% · 12 months |
| Offline behaviour | user gets kicked | user gets kicked | configurable grace, up to 72h |
| Written uptime SLA | none | verbal | 99.99%, credits in contract |
| Kill switch scope | delete the file, pray | per script | script · build · version range · single key |
| HWID resets | manual, in DMs | manual with a cap | self-service, budgeted per user |
| Ad / reward revenue cut | — | 10–20% platform fee | 0% — we never touch it |
| Source retention | on a VPS someone leaked in 2024 | stored for re-obfuscation | 0 bytes by default, opt-in sealed vault |
| Anti-tamper | none | signature check | integrity + fp scoring + decoy builds |
| Key Check API before execution | n/a | basic | full JSON, 40+ fields, typed SDKs |
| Team seats & audit log | shared FTP password | owner only | roles, 2FA, 90-day searchable log |
| Migration from another service | n/a | n/a | import your keys & expiry dates free |
No subscriptions, no per-execution billing, no revenue share. One-time payment, lifetime access. Every plan includes HWID locking, keyless mode and the kill switch.
Ship your first script and keep it yours.
For a growing hub with multiple scripts.
More room as you ship more scripts.
A one-time payment unlocks your plan for life — no monthly charges, no renewals, nothing to cancel.
Upgrades are delivered as a redeem code you enter from your dashboard — your plan changes instantly.
Create an account and explore the whole dashboard on the Free plan. Upgrade only when you need more scripts.
★★★★★"Launch day used to mean sitting in Discord refreshing status. 41k executions in two hours, zero auth errors, and I went to bed at 1am like a normal person."
★★★★★"We moved 6,400 live keys over in an afternoon with the importer. Expiry dates, HWIDs, notes, all intact. Our old service had been quietly dropping resets for a year."
★★★★★"Runtime variables replaced an entire second hub. I give my resellers a tier flag and my beta group gets features a build earlier — one codebase, one key system."
★★★★★"A leaker dumped my build. Kill switch scoped to that version range killed it in front of everyone, and the decoy payload made their 'bypass' video useless. Best $40 I spend."
★★★★★"Reward links were 80% of my income last quarter and I keep every cent of it. The completion proof stopped the bot-farm clicks that ate 30% of my revenue before."
★★★★★"My users are teenagers on phones. Self-service HWID reset with a 3-per-month budget killed 90% of my support queue overnight. The bot does the work I used to do."
Illustrative copy for this build — replace with your own verified customer quotes before launch.
AES-256-GCM using a passphrase only you hold — we cannot read them, and we cannot restore them for you.HttpGet/request and a loadstring — Windows, macOS, Android and ARM builds included. The loader needs no library, no external binary and no privileged API. If your target can't make an HTTPS request, the offline grace mode plus pre-issued tokens still works; ask us and we will write the shim.Spin up a workspace, upload one script and see a signed, hardware-locked build in under two minutes. Fourteen days of Premium on the house — no card, no sales call, no lock-in.