Edge auth v3 · 11 ms p50 · 41 regions

Protect, monetize &
  • ship.
  • scale.
  • defend.
  • automate.
  • ship.

Spider Hub is the whitelist, licensing and revenue layer for Lua & Luau script developers. Upload your source once — we embed hardware-locked auth, obfuscate it, and hand you a dashboard, Discord bot, key API and kill switch that never blinks during a launch day.

  • No card required
  • Drop-in loader, 1 line
  • 99.99% uptime SLA
  • Cancel & stack anytime
OverviewYour scripts, keys and players at a glance
Discord Linked+ New project
0Projects
0Scripts
0License keys
0Bound devices
Keys created · last 14 days+312
78%
  • Active1.6k
  • Unbound420
  • Banned88
Recent key activity
    Verified on
    Here are our stats

    Trusted with real revenue

    Numbers below are pulled from the same metrics page the dashboard exposes to every account — not a marketing screenshot.

    Active keys0Lifetime & day-locked, hardware bound
    Auth checks / month0Median round trip 11 ms, p99 74 ms
    Uptime · 12 mo0Backed by a written SLA on Pro & above
    Paid to developers0Reward-link revenue since launch

    * Aggregated across all tenants since November 2024. Reward revenue is developer-earned, not ours.

    Architecture

    A stability-first
    approach to
    whitelist security

    Auth failures don't just annoy users — they kill a launch day, refund a month of sales and leak your hub to the free-rip channels. So we built the control plane the way SRE teams build payment systems: everything stateless at the edge, everything replicated, nothing that can hang your loader.

    • 41 edge regions, anycast in front

      Every check terminates at the closest point of presence and is answered from a replicated read replica. No region is authoritative for your users.

    • Stateless, idempotent verification

      Tokens are signed and verifiable on their own, so a packet loss, a cold node or a rolling deploy produces the exact same answer: 0.000% auth error rate over 12 months.

    • Offline grace windows

      Set 15 minutes or 72 hours. If a player loses connection mid-session, the loader keeps running instead of kicking them — then silently re-syncs.

    • Zero-downtime key rotation

      Rotate signing keys with a dual-active overlap. Nothing you shipped last year ever stops validating.

    See the exact request /files/v4/auth Read the threat model
    Spider Hub edge network healthy · 41 nodes
    Integration

    Three steps. No rewrite.

    You do not change your script architecture, your executor targets or your sales flow. You replace one line — everything else is policy you configure from the dashboard.

    Upload your source

    Drag the raw Lua into the dashboard, or hit the API from CI. We obfuscate, embed the whitelist and hand back a build id. Your source is shredded after build unless you opt into the encrypted vault.

    avg. build time4.6s / 100 KB

    Point users at one line

    Ship a short loader that resolves the build, verifies the key and calls back into your code. It is under 300 bytes and safe to make public — there is nothing inside it to reverse.

    loader size284 bytes

    Run the business

    Stock keys for Sellix / Share.Online, let the Discord bot redeem them, watch webhooks fire, and use the kill switch if a build leaks. Update code without asking anyone to redownload.

    kill switch propagation380 ms global
    -- everything a script author has to write, forever
    
    local Spider Hub = loadstring(game:HttpGet("https://cdn.spiderhub.xyz/loader/v3"))
    Spider Hub:init({
      scriptId = "8f2a-91c0-nova-hub",
      hwid     = true,   -- bind device + executor
      grace    = 3600,   -- seconds of offline play
      onFail   = function (reason, detail)
        if reason == "KEY_EXPIRED" then
          return ui:renewPrompt(detail.renewUrl) -- no kick, no crash
        end
        return ui:notice(reason)
      end,
      vars     = { "tier", "note", "expires", "groupRank" }
    })
    Spider Hub:run(function ()
      if LS.vars.tier == "premium" then enableModule("autoRaid") end
    end)

    Nothing of yours ever sits on our servers

    The build happens in an ephemeral sandbox; the plaintext is shredded the moment obfuscation completes. What we keep is a hash of your source, the build manifest and the metadata your policy needs. If you enable Verified, a human reviewer sees anonymised code and it is deleted within the hour.

    source retained by default0 bytes
    at-rest encryptionAES-256-GCM
    key custodytenant-scoped, HSM
    data deletion SLA< 60 min
    Powerful features you'll actually use

    Everything a script business needs — and nothing it has to bolt on

    Fourteen systems that would otherwise be a Discord ticket queue, a PHP folder on a shared VPS and three pastebin scripts. Included in every paid plan.

    Managed

    Discord bot with a real control panel

    Redeem, check status, reset HWID, open tickets and receive role grants — inside your server, no site login for the average user. Bring your own bot token or use ours; every action is mirrored to the same audit log your staff sees on the web.

    nova-bot · #key-support
    ✔ NOVA-7Q2P-XK19-M4AZ redeemed → HWID b41f…9ac2 · 30d premium
    → role "Premium" granted · webhook sent · expiry 03 Nov 2026

    Key stocking & export

    Generate 5 or 50,000 keys with day-lock, lifetime or usage caps, prefix them for your brand, then export CSV / TXT straight into Sellix, Share.Online or a Google Sheet. Duplicate protection and per-batch limits included.

    keys minted this batch500
    redeemed391 · 78%

    Runtime variables

    Per-key data your code can read — Discord ID, note, expiry, plan tier, arbitrary JSON — so you branch for a single user, an affiliate or a beta group without shipping a second build.

    LS.vars = { tier="premium", seat=2, beta=true }
    380 ms

    One-click kill switch

    Disable a build, a script, a tier or a single leaked key. Scope it to a version range so old buyers keep working while the leaked build dies. Every execution after that returns your custom message.

    Encrypted vault & rollback

    Opt in and every build is sealed with your own passphrase and stored, so losing your laptop is a bad afternoon rather than a lost product. Roll any script back to a previous build in one click.

    Reward-link ad system

    Monetise free users with Linkvertise, LootLabs, AdMaven or your own shorteners. Server-side completion proof means no fake passes, and we take 0% of what you earn.

    completed today1,204 clicks
    payout to you$41.20 · 0% cut

    Anti-tamper & fingerprinting

    Integrity hash on the payload, emulator/clone detection, session binding, VM and proxy scoring. Suspicious executions are served a decoy build instead of an error, so leakers learn nothing from probing.

    Webhooks & audit log

    Every redeem, reset, refund request, kill switch flip and blocked execution hits Discord or your endpoint with the full actor chain. Searchable for 90 days, exportable forever.

    Automatic integration

    The whitelist is embedded at build time with a Luraph-class VM pass — no wrapper file, no hand-written auth block, and nothing for a buyer to strip out by deleting the top ten lines.

    Teams, roles & resellers

    Give staff read-only access, let a reseller mint keys for one script only, and require 2FA on anything destructive. Every action is attributed — no shared logins at 3am.

    Analytics that answer questions

    DAU by script, executions by executor and country, churn on day-locked keys, revenue per affiliate and the top 10 failed-status reasons — with a CSV export for your accountant.

    Affiliate & reseller codes

    Issue a prefixed batch to each reseller or affiliate, then see exactly whose keys are running, whose are refunding and who is leaking. Payout percentages and per-seller caps are enforced at verification time, not by trust.

    Support tools for buyers

    Self-service reset links, a copyable diagnostic bundle, status page per script and canned replies. Your ticket volume drops because 90% of "the key is broken" is a stale HWID.

    Opt-in

    Verified-script review

    Volunteer your source for a human review and earn a Verified badge buyers can filter on. Reviewers see anonymised code, and it is deleted within the hour. Once enabled it cannot be switched off — that is the point.

    POST /v3/verify

    Poke the auth engine. Right here.

    Pick a scenario and watch each verification stage resolve in the order your users hit it — the same response shape, error codes and remedies the real API returns. No signup, no rate limit.

    Verification pipeline
      Incoming request
      
              
      Response · —
      
                
      The honest comparison

      Against the two ways most people do this today

      Rolling your own auth gives you a maintenance burden you never budgeted for. A legacy whitelist gives you a shared, single-region key server and a changelog nobody reads. Numbers are p50 over a 30-day window.

      Capability DIY PHP + pastebin Legacy whitelist Spider Hub
      Median auth latency340 ms (1 region)182 ms11 ms · 41 regions
      Auth error ratedepends on your hosting0.8–2.4% on launch day0.000% · 12 months
      Offline behaviouruser gets kickeduser gets kickedconfigurable grace, up to 72h
      Written uptime SLAnoneverbal99.99%, credits in contract
      Kill switch scopedelete the file, prayper scriptscript · build · version range · single key
      HWID resetsmanual, in DMsmanual with a capself-service, budgeted per user
      Ad / reward revenue cut—10–20% platform fee0% — we never touch it
      Source retentionon a VPS someone leaked in 2024stored for re-obfuscation0 bytes by default, opt-in sealed vault
      Anti-tampernonesignature checkintegrity + fp scoring + decoy builds
      Key Check API before executionn/abasicfull JSON, 40+ fields, typed SDKs
      Team seats & audit logshared FTP passwordowner onlyroles, 2FA, 90-day searchable log
      Migration from another servicen/an/aimport your keys & expiry dates free
      Simple, one-time pricing

      Pay once. Yours for life.

      No subscriptions, no per-execution billing, no revenue share. One-time payment, lifetime access. Every plan includes HWID locking, keyless mode and the kill switch.

      Free

      Ship your first script and keep it yours.

      $0
      free forever
      • 1 project
      • 1 script
      • Unlimited license keys
      • HWID locking
      • Keyless (FFA) mode
      • Kill switch & HWID bans
      Create account
      Most popular

      Premium

      For a growing hub with multiple scripts.

      $5
      one-time · lifetime
      • 6 projects
      • 10 scripts
      • Everything in Pro
      • Unlimited license keys
      • Keyless mode & kill switch
      • Priority support
      Get Premium

      Pro

      More room as you ship more scripts.

      $3
      one-time · lifetime
      • 3 projects
      • 5 scripts
      • Unlimited license keys
      • HWID locking
      • Keyless (FFA) mode
      • Kill switch & HWID bans
      Get Pro
      We accept BTC ETH USDT Card / Apple Pay PayPal

      Pay once, keep it forever

      A one-time payment unlocks your plan for life — no monthly charges, no renewals, nothing to cancel.

      Redeem a code to upgrade

      Upgrades are delivered as a redeem code you enter from your dashboard — your plan changes instantly.

      Start free

      Create an account and explore the whole dashboard on the Free plan. Upgrade only when you need more scripts.

      From the people shipping on it

      Fewer tickets. Longer launches.

      ★★★★★

      "Launch day used to mean sitting in Discord refreshing status. 41k executions in two hours, zero auth errors, and I went to bed at 1am like a normal person."

      NV
      n0vaNovaHub · 12k buyers
      Pro
      ★★★★★

      "We moved 6,400 live keys over in an afternoon with the importer. Expiry dates, HWIDs, notes, all intact. Our old service had been quietly dropping resets for a year."

      KL
      kyllLumen Team · lead
      Premium
      ★★★★★

      "Runtime variables replaced an entire second hub. I give my resellers a tier flag and my beta group gets features a build earlier — one codebase, one key system."

      DR
      drenDrift Suite
      Pro
      ★★★★★

      "A leaker dumped my build. Kill switch scoped to that version range killed it in front of everyone, and the decoy payload made their 'bypass' video useless. Best $40 I spend."

      SX
      syntaxVertex · solo dev
      Pro
      ★★★★★

      "Reward links were 80% of my income last quarter and I keep every cent of it. The completion proof stopped the bot-farm clicks that ate 30% of my revenue before."

      MI
      miraHalo Scripts
      Premium
      ★★★★★

      "My users are teenagers on phones. Self-service HWID reset with a 3-per-month budget killed 90% of my support queue overnight. The bot does the work I used to do."

      AO
      aoiSakura Hub
      Basic

      Illustrative copy for this build — replace with your own verified customer quotes before launch.

      F.A.Q

      The questions we get asked weekly

      01Do you keep a copy of my source code?
      By default, no. Your source is streamed into an ephemeral build sandbox, obfuscated, and the plaintext is shredded as soon as the build is signed. What we retain is the SHA-256 of the payload, the build manifest and the policy metadata needed to authenticate. If you switch on the encrypted vault, copies are sealed with AES-256-GCM using a passphrase only you hold — we cannot read them, and we cannot restore them for you.
      02What happens to my users if Spider Hub goes down?
      Nothing they can see. Verification tokens are self-contained, so a loader inside its grace window keeps running without contacting us at all. Set the window to 15 minutes or 72 hours per script. Auth endpoints are anycast across 41 regions, so a region failure reroutes mid-session; you get an SLA credit if we ever miss 99.99%.
      03Can a determined leaker just bypass the whitelist?
      Any client-side check can be attacked — the goal is making it more expensive than buying a key. We sign the loader, verify a build-level integrity hash server-side, score the fingerprint, bind the HWID, serve a decoy build instead of an error when tampering is detected, and expire tokens on a short TTL so a captured payload is not reusable. Combined with the per-key instance caps, mass redistribution dies in hours, not months.
      04How do I move from another whitelist service?
      Use the importer: upload a CSV of codes, expiry timestamps, HWIDs and notes, or hand us your old service's API key and we pull it. Keys keep their remaining time, existing buyers never re-register, and we run both services in shadow mode for as long as you like so you can compare the responses before switching the loader.
      05Is the obfuscation really included?
      Yes — unlimited on every paid plan, including the trial. One Luraph-class VM pass with control-flow flattening, string encryption and anti-debug is embedded at build time. Premium and above can request a hardened profile (namespace collisions, per-function key rotation, decoy control branches). We do not charge per obfuscation and we do not cap monthly builds.
      06What is HWID exactly, and are you tracking people?
      A salted hash of non-identifiable device and executor properties — never a username, never a file path, never anything a user typed. It exists so one key cannot be shared across 400 machines. The hash is only meaningful to your script, and users get a self-service reset budget so a reinstall does not become a support ticket.
      07Which executors and platforms work?
      Everything that can run HttpGet/request and a loadstring — Windows, macOS, Android and ARM builds included. The loader needs no library, no external binary and no privileged API. If your target can't make an HTTPS request, the offline grace mode plus pre-issued tokens still works; ask us and we will write the shim.
      08Do you take a cut of my ad revenue?
      No. Reward links pay you directly from the network you choose; we take 0% and we never sit in the payout path. We publish per-network completion rates so you can see why a click did not convert instead of guessing — and you can plug in your own shortener with custom URLs on Pro.
      09Is this allowed with Roblox's ToS?
      Spider Hub protects and licenses your own code; it does not inject into games, exploit other players or automate purchases. Scripting itself sits in a grey area that you and your users are responsible for, and we do not permit scripts whose purpose is stealing, trading abuse or account compromise — those are rejected from Verified mode and removed under our ToS.
      10What does the Enterprise plan actually unlock?
      Dedicated capacity and a rate-limit bypass, per-key instance caps, execution ceilings, HWID-less modes, cloned-emulator allow/blocklists, custom ad URLs on your own domain, SSO for staff, a signed DPA with uptime credits, and a direct line to the engineers who run the build pipeline for feature requests.

      Your code, your rules, your money

      Spin up a workspace, upload one script and see a signed, hardware-locked build in under two minutes. Fourteen days of Premium on the house — no card, no sales call, no lock-in.

      provision in 90 seconds free key import cancel with one code
      Copied