VERSION 1.1 · TECHNICAL REFERENCE

Developer documentation

Programmatic builds, Luau source annotations, runtime options and operational limits for LuaUObfuscator. The public build modes are Moon VM (v1) and Sun VM (v2).

API v1 Output V1.1 Luau

API authentication

Developer API access requires an active Premium or Commercial membership. Create a key in Workspace → API Key. Each key is displayed once; generating a replacement immediately invalidates the previous key. Premium accounts may run up to 3 concurrent API builds; Commercial accounts may run up to 5.

Send the key with the standard bearer scheme. Do not embed a developer API key in scripts distributed to clients.

Authorization: Bearer luo_your_api_key
Content-Type: application/json

Billing: each successful developer API build consumes exactly one token, separately from the plan's compilation quota. Check the token balance before starting a batch.

Compile request

POST /api/v1/obfuscate

Base URL: https://luauobfuscator.win. Submit JSON encoded as UTF-8.

Field	Type	Details
`source`	string	Required. Luau source code.
`filename`	string	Optional. Suggested output filename.
`version`	string	`moon` for Moon VM or `sun` for Sun VM. The compatibility aliases `v1`/`v2` are also accepted.
`protection`	string	`standard` or `strong`.
`intense_structure`	boolean	Adds more protection layers and VM processing to make reconstruction and analysis more difficult; Premium or Commercial.
`virtualization_handlers`	integer	Handler count, 1–500. Higher values can increase output size.
`anti_debug`	boolean	Debug Checks. Uses the debug library for extra protection when the environment supports it; optional for both Moon VM and Sun VM.
`runtime_trace`	boolean	Strong Anti Tamper. Adds extra protection but may reduce compatibility with some executors; defaults to `true`.
`vm_compression`	boolean	Applies strong compression to the VM; available to Pro, Premium, and Commercial.

{
  "filename": "script.luau",
  "source": "print('Protected')",
  "version": "sun",
  "protection": "strong",
  "intense_structure": false,
  "virtualization_handlers": 220,
  "anti_debug": true,
  "runtime_trace": true,
  "vm_compression": false
}

VM family selection, server runtime challenges and experimental interpreter layering are not exposed in V1.1.

Response and download

Successful compilation returns an output-file descriptor, build metadata, remaining tokens and plan-quota information. The returned download URL requires the same bearer key. Output files remain available for 24 hours. Premium accounts may run up to 3 API builds concurrently; Commercial accounts may run up to 5.

{
  "ok": true,
  "file": {
    "id": "...",
    "filename": "script.obfuscated.lua",
    "download_url": "/api/v1/files/...",
    "expires_at": 1790000000
  },
  "remaining_tokens": 87,
  "plan_remaining": 996,
  "plan_used": 4,
  "plan_limit": 1000,
  "plan": "Premium",
  "vm_build_id": 123456,
  "compile_ms": 842,
  "strong_anti_tamper": true
}

Client code should check HTTP status codes and the JSON ok field. Requests may be rejected for expired credentials, insufficient tokens, invalid source, rate limits or resource limits. Do not assume the illustrative values above are fixed.

Python integration

import os
import requests

base = "https://luauobfuscator.win"
headers = {"Authorization": "Bearer " + os.environ["LUO_API_KEY"]}

with open("script.luau", encoding="utf-8") as file:
    source = file.read()

response = requests.post(
    base + "/api/v1/obfuscate",
    headers=headers,
    json={"filename": "script.luau", "source": source,
          "version": "sun", "protection": "strong"},
    timeout=120
)
response.raise_for_status()
result = response.json()
download = requests.get(base + result["file"]["download_url"],
                        headers=headers, timeout=60)
download.raise_for_status()
with open(result["file"]["filename"], "wb") as file:
    file.write(download.content)

JavaScript / Node.js integration

import { readFile, writeFile } from "node:fs/promises";

const base = "https://luauobfuscator.win";
const headers = { Authorization: "Bearer " + process.env.LUO_API_KEY };
const source = await readFile("script.luau", "utf8");

const response = await fetch(base + "/api/v1/obfuscate", {
  method: "POST",
  headers: { ...headers, "Content-Type": "application/json" },
  body: JSON.stringify({
    filename: "script.luau", source,
    version: "sun", protection: "strong"
  })
});
if (!response.ok) throw new Error(await response.text());
const result = await response.json();
const download = await fetch(base + result.file.download_url, { headers });
if (!download.ok) throw new Error(await download.text());
await writeFile(result.file.filename, Buffer.from(await download.arrayBuffer()));

Compiler modes

Mode	API value	Intended use
Moon Standard / Moon Strong	`version: "moon"` + `protection: "standard" \| "strong"`	—
Sun Standard / Sun Strong	`version: "sun"` + `protection: "standard" \| "strong"`	—

Moon and Sun are the API's preferred names. Existing integrations using v1 and v2 continue to work.

Luau source macros

Region directives apply to the immediately following function(...) ... end or named function declaration. These directives are processed at compile time and are not standard Luau syntax on their own.

-- Native function. Preserve original identifiers and literal text.
LUO_NO_VIRTUALIZE()
local function getUrl(base, path)
    local result = base .. "/" .. path
    return result
end

-- Native function with strong AST transforms and Base92 string transport.
LUO_NO_VIRTUALIZE, TRANSFORM(AST)
local function securedUrl()
    return "https://example.invalid/api"
end

-- Skip the VM for this function; do not apply AST transformations.
LUO_VM(NONE)
local function calculate(value)
    return value * 4
end

-- Apply AST without a separate virtualization-policy directive.
LUO_TRANSFORM(AST)
function()
    print("Native AST function")
end

LUO_VM(NONE), TRANSFORM(AST) is also supported and uses the native AST path. Existing function-wrapper forms, such as LUO_NO_VIRTUALIZE(function(x) return x end), remain compatible.

Unknown calls in the reserved LUO_* and LP_* macro namespaces stop compilation with an explicit macro error. Source syntax errors and unsupported Luau features are also returned with their compiler message and source position when available.

String encoding and cooperative termination

local endpoint = LUO_ENCSTR("https://example.invalid/private")

if not isAuthorized() then
    LUO_CRASH()
end

LUO_ENCSTR encodes a constant string for runtime restoration. LUO_CRASH() is a standalone statement that stops execution cooperatively in the generated runtime; it does not terminate unrelated Roblox callbacks.

Native output and AST / Base92

LUO_NO_VIRTUALIZE emits a native Luau function, retains original parameter and local names, and keeps captured variable identifiers readable. Captured variables still use the surrounding runtime's reference cells to preserve read/write behavior; their accesses may therefore include a .v suffix.

TRANSFORM(AST) is an explicit opt-in. It renames AST-region variables, rewrites selected expressions and branches, and stores string constants in Base92-encoded, byte-scrambled pools. The factory decodes those pools when the closure is created, rather than on every function invocation.

Important: Base92 is an encoding layer, not cryptography. AST transformations and runtime decoding increase the work required to inspect code; they cannot make values permanently secret on a client machine.

Runtime protections

Debug Checks uses the debug library for extra protection when the target environment supports that library. Strong Anti Tamper adds extra protection, but may reduce compatibility with some executors. Both switches can be enabled or disabled independently for Moon VM and Sun VM.

Intense VM Structure adds more protection layers and VM processing to make reconstruction and analysis more difficult. VM Compression applies strong compression to the VM. They can increase build time or execution overhead. Test the protected file under your intended Roblox environment before release.

Limits and operational notes

Input source limit: up to 2 MiB for Pro, Premium, and Commercial; 1 MiB for Basic.
Generated output is subject to compilation, memory and size limits.
Recent protected files expire after 24 hours; maintain your own release artifacts.
Obfuscation does not replace server-side authorization or secure storage of credentials.
Compatibility and performance depend on the Luau features used in your source and the target runtime.