Panda Auth · Universal key system
Ask one question — is this key allowed on this device, right now? Get a server-side answer, HWID-locked keys, and built-in monetization where you keep 100% of the revenue. Universal SDKs for Lua, JavaScript, Python and C#.
What is Panda Auth
Panda Auth is a universal key system. You gate access behind a GetKey page, hand out keys locked to a device's HWID, and answer one question at runtime — is this key allowed on this device, right now? Here is the whole loop.
Create a service in your dashboard. It gets a unique identifier.
Distribute its GetKey link: ads.pandauth.com/getkey/<identifier>?hwid=<device>
The user clears checkpoints — one to ten ad steps you monetize and keep 100% of.
The server issues an HWID-bound key, pinned to that one device.
Your software validates it server-side and only runs when the answer is “Valid”.
Why Panda Auth
Not a longer feature list — four things most key systems can’t say, and the real product behind them.
Connect your own ad-provider credentials — Linkvertise, Lootlabs, Work.ink, AdMaven and more. Money flows provider → you. Panda never sits in the middle and never takes a cut.
Three of the five tiers cost $0, forever. The free plan can create services, hand out keys and monetize — not a locked trial waiting for a paywall.
The "is this key allowed on this device?" decision is made on the server from the key, HWID and service together — not a client-side check an executor can patch out.
One auth platform across Lua, JavaScript, Python and C#, with a one-line loadstring or a single validate() call. Built for any runtime, not Roblox-only.
my keys
The real dashboard, placeholder data
| Key | Service | Status | Obtained | Expires | HWID |
|---|---|---|---|---|---|
PNDA-A8F2-XR4Q-N7K3 | Your service/your-service | Active | Today14:02 | in 30 days | |
PNDA-9HT6-MWZ1-P2L8 | Sample script/sample-script | Active | Yesterday09:41 | in 12 days | |
PNDA-4KFM-BS7E-J0R5 | Demo plugin/demo-plugin | Expired | Mar 321:18 | expired | — |
How it works
Panda Auth handles the hard parts — identity pinning, sandbox gating, and obfuscation — so your integration stays small. Here is the whole flow.
Every project is a 'service' in your dashboard with its own identifier. Generate HWID-locked keys in bulk or on demand, set expiry windows, maintain a whitelist of trusted users, and revoke any key the moment it leaks.
Turn keys into revenue with built-in ad-gate checkpoints — Linkvertise, LootLabs, AdMaven, and Work.ink — including Secured modes that validate completion server-side so a checkpoint cannot be skipped. You keep 100% of the provider revenue.
Upload your Lua to the Kryptic Vault instead of pasting it in plaintext. Choose a Luraph or IronBrew obfuscation pass, and the platform delivers it through a reinforced loader with sandbox and anti-dump gating.
On execution the loader sends the key and device HWID to the server, which validates everything before releasing the payload. Runtime variables are injected as globals, and Discord webhooks plus analytics give you a live view of who is authenticating.
The whole client-side integration
Paste the Kryptic Vault loader into your executor, then gate your code behind a single Pelinda validation call. That is the entire footprint on the client.
loadstring(game:HttpGet("https://vss.pandauth.com/kv/abc123"))()local result = Pelinda.Init({ Key = "PANDA-XXXX-XXXX-XXXX-XXXX" })
if result == "validated!!" then
-- your script runs
else
print("Get a key: " .. Pelinda.GetKeyLink())
endGet started
Four steps — account, service, loader, ship.
Email and password. No card, no waitlist.
Name it, pick checkpoints and choose an ad provider. The identifier you set is how the SDK finds it.
The display name for your service
Store your script in the cloud, obfuscate it with Kryptic, then hand users a one-line loadstring with the key system baked in.
loadstring(game:HttpGet("https://vss.pandauth.com/kv/a1b2c3d4e5f6a7b8"))()Users grab keys, your ad provider pays you, and the dashboard shows services, keys and executions live.
Total Services
3
Active Keys
142
Executions
8,420
Panda Tokens
10
Kryptic Vault · Server-side script hosting
Upload your Lua and Kryptic obfuscates it and stores it server-side. Users get a single loadstring loader instead of a copy of your source, and only devices with a valid Panda Auth key can pull the build.
AES-256 at rest
Every build is stored AES-256 encrypted, so a database dump doesn't hand over your source in plaintext.
Key-gated delivery
Scripts are only served to users holding a valid, HWID-locked Panda Auth key. No key, no payload.
Single loadstring loader
Ship one short loadstring line. The obfuscated build is fetched from the vault at run time instead of being pasted around.
Version control & rollback
Keep a full history of every deploy and roll back to any previous version in seconds if a build misbehaves.
Instant push updates
Push a new build and every user picks it up on their next load — no re-sharing files with your community.
Two transports
Delivery runs over WebSocket by default, with an HTTP “Compatible Mode” fallback for locked-down environments.
| No. | Script | Obfuscation | Status | Size |
|---|---|---|---|---|
| 1 | your_script.lua v1 | Luraph | Ready | — |
| 2 | ||||
| 3 |
Security
No protection is unbreakable — so Panda Auth stacks independent layers. Each one raises the cost of a bypass, and a weakness in any single layer does not expose your whole script.
Bind every key to a hardware fingerprint so one purchase cannot be shared across a Discord server. Set multi-HWID limits for users with more than one machine, and enforce the binding server-side so a client-side patch cannot fake a foreign device.
Pass your Lua through Luraph or IronBrew before delivery. Identifier renaming, string encryption, and VM-based protection make your source painful to read, modify, or re-upload — turning casual theft into serious effort.
Scripts are delivered through a loader that performs sandbox and anti-dump gating, with anti-environment-logger checks that block memory loggers before any sensitive traffic flows. Your real payload is only handed out after every check passes.
Hardened clients like V5 (Jellybean) pin the server’s long-term Ed25519 identity, so a URL-redirect or spoofed server is rejected before a single byte of script is delivered — defeating static-patcher and man-in-the-middle bypasses.
Authentication is decided on the server, not the client. Keys, HWID, and service all have to line up at validation time, transport is encrypted over WSS (with an HTTP fallback), and endpoints are rate-limited to blunt replay and brute-force attempts.
Revoke a leaked key once and every device tied to it stops working. Discord webhooks and dashboard analytics surface validations, executions, and abuse patterns in real time so you can react before a leak spreads.
A note on honesty: we don’t market any layer as “undetectable” or “unbypassable.” Good security is about raising cost and buying time, and that is exactly what these layers do together.
Users
Services
Active keys
Protected scripts
Uptime
Testimonials
Script devs who picked Panda Auth and stuck with it. Real services, not stock photos.
“Setup took about ten minutes. Dashboard is clean, keys just work, and the HWID lock has stopped sharing dead in its tracks.”
Silent Caliber
Developer at Punk X
“Moved my whole script library over. Cut my support DMs in half — Panda AI catches the basic “key not working” stuff before it reaches me.”
blue ball
Developer at Chosen Hub
“Linkvertise + LootLabs side-by-side per checkpoint is what sold me. Other panels make you pick one. Revenue went up the first week.”
Sebastian Paul
Developer at Skull Hub
“The 5-line loader is genuinely 5 lines. No 40kb of obfuscated junk to paste before my script even loads.”
ktrov3
Developer at zzzhub2
Get started
Spin up a service. Generate keys. Sleep well.$0. Forever.