Panda Auth · Universal key system
Keys locked to one device, checked on our server. The built-in ad gate pays you directly. Works with Lua, JavaScript, Python and C#.
What is Panda Auth
Panda Auth is a universal key system. You put access behind a GetKey page, hand out keys locked to a device HWID, and check them on the server before your code runs. Here is the full loop.
Create a service in your dashboard. It gets a unique identifier.
Share its GetKey link: ads.pandauth.com/getkey/<identifier>?hwid=<device>
The user clears checkpoints. One to ten ad steps, and you keep all of what they earn.
The server issues an HWID-bound key, tied to that one device.
Your software checks it server-side and only runs when the answer is “Valid”.
Why Panda Auth
Short list, no filler. Every one of them ships today.
Connect your own ad provider accounts: Linkvertise, Lootlabs, Work.ink, AdMaven and others. The provider pays you directly. Panda never holds your money and never takes a cut.
Three of the five tiers cost $0 and stay that way. The free plan can create services, hand out keys and run monetization. Nothing is waiting behind a countdown.
Key, HWID and service are checked together on our server. There is no client-side check for an executor to patch out.
One platform for Lua, JavaScript, Python and C#, with a one-line loadstring or a single validate() call. It works outside Roblox too.
my keys
The real dashboard, sample data
| Key | Service | Status | Obtained | Expires | HWID |
|---|---|---|---|---|---|
PNDA-A8F2-XR4Q-N7K3 | Your service/your-service | Active | Today14:02 | in 30 days | |
PNDA-9HT6-MWZ1-P2L8 | Sample script/sample-script | Active | Yesterday09:41 | in 12 days | |
PNDA-4KFM-BS7E-J0R5 | Demo plugin/demo-plugin | Expired | Mar 321:18 | expired | Off |
How it works
Panda Auth handles identity pinning, sandbox gating and obfuscation, so your side of the integration stays small. Here is the full flow.
Every project is a 'service' in your dashboard with its own identifier. Generate HWID-locked keys in bulk or one at a time, set expiry windows, keep a whitelist of trusted users, and revoke any key that leaks.
Turn keys into revenue with ad-gate checkpoints from Linkvertise, LootLabs, AdMaven and Work.ink. Secured modes verify completion on the server, so a checkpoint cannot be skipped. All provider revenue goes to you.
Upload your Lua to the Kryptic Vault instead of pasting it in plaintext. Pick a Luraph or IronBrew obfuscation pass, and the platform serves it through a reinforced loader with sandbox and anti-dump checks.
At runtime the loader sends the key and device HWID to the server, which checks both before releasing the payload. Runtime variables arrive as globals, and Discord webhooks plus analytics show you who is authenticating.
The whole client-side integration
Paste the Kryptic Vault loader into your executor, then wrap your code in one Pelinda validation call. That is all the client ever sees.
loadstring(game:HttpGet("https://vss.pandauth.com/kv/abc123"))()local result = Pelinda.Init({ Key = "PANDA-XXXX-XXXX-XXXX-XXXX" })
if result == "validated!!" then
-- your script runs
else
print("Get a key: " .. Pelinda.GetKeyLink())
endGet started
Four steps: account, service, loader, ship.
Email and password. No card, no waitlist.
Name it, pick your checkpoints and pick an ad provider. The identifier you set is how the SDK finds it.
The display name for your service
Store your script in the cloud, obfuscate it with Kryptic, then give users a one-line loadstring with the key system built in.
loadstring(game:HttpGet("https://vss.pandauth.com/kv/a1b2c3d4e5f6a7b8"))()Users grab keys, your ad provider pays you, and the dashboard tracks services, keys and executions live.
Total Services
3
Active Keys
142
Executions
8,420
Panda Tokens
10
Kryptic Vault · Server-side script hosting
Upload your Lua. Kryptic obfuscates it and stores it on our servers. Users get one loadstring line instead of a copy of your source, and only devices with a valid Panda Auth key can pull the build.
AES-256 at rest
Every build is stored with AES-256 encryption, so a database dump does not hand over your source in plaintext.
Key-gated delivery
Scripts go out only to users holding a valid, HWID-locked Panda Auth key. No key, no payload.
Single loadstring loader
Ship one short loadstring line. The obfuscated build is pulled from the vault at run time instead of being passed around.
Version control & rollback
Keep the full history of every deploy and roll back to any earlier version in seconds when a build breaks.
Instant push updates
Push a new build and every user gets it on their next load. You never re-share files with your community.
Two transports
Delivery runs over WebSocket by default, with an HTTP “Compatible Mode” fallback for locked-down environments.
| No. | Script | Obfuscation | Status | Size |
|---|---|---|---|---|
| 1 | your_script.lua v1 | Luraph | Ready | n/a |
| 2 | ||||
| 3 |
Security
No protection is unbreakable. Panda Auth stacks independent layers instead, so breaking one of them does not hand over your whole script.
Bind every key to a hardware fingerprint so one purchase cannot be passed around a Discord server. Set multi-HWID limits for users with more than one machine. The binding is enforced on the server, so a client-side patch cannot fake another device.
Run your Lua through Luraph or IronBrew before delivery. Identifier renaming, string encryption and VM-based protection make the output hard to read, edit or re-upload.
Scripts are delivered through a loader that runs sandbox and anti-dump checks, plus anti-environment-logger checks that block memory loggers before any sensitive traffic. The real payload only goes out after every check passes.
Hardened clients like V5 (Jellybean) pin the server’s long-term Ed25519 identity. A redirected URL or a spoofed server is rejected before any script is sent, which stops static patchers and man-in-the-middle bypasses.
Authentication is decided on the server, not the client. Key, HWID and service all have to match at validation time. Transport is encrypted over WSS with an HTTP fallback, and endpoints are rate-limited against replay and brute force.
Revoke a leaked key once and every device tied to it stops working. Discord webhooks and dashboard analytics show validations, executions and abuse patterns in real time.
We do not call any layer “undetectable” or “unbypassable”. What these layers do is make a bypass expensive and slow enough that most people give up.
Users
Services
Active keys
Protected scripts
Uptime
Testimonials
Script devs running real services on Panda Auth.
“Setup took about ten minutes. Dashboard is clean, keys just work, and the HWID lock has stopped sharing dead in its tracks.”
Silent Caliber
Developer at Punk X
“Moved my whole script library over. Cut my support DMs in half. Panda AI catches the basic “key not working” stuff before it reaches me.”
blue ball
Developer at Chosen Hub
“Linkvertise + LootLabs side-by-side per checkpoint is what sold me. Other panels make you pick one. Revenue went up the first week.”
Sebastian Paul
Developer at Skull Hub
“The 5-line loader is genuinely 5 lines. No 40kb of obfuscated junk to paste before my script even loads.”
ktrov3
Developer at zzzhub2
Get started
Create a service. Generate keys. Go live.$0. Forever.