1. Secure API management
Open the secure administrator console on this same LuaRN website. Use it to create keys, set daily quotas and expiry, inspect traffic analytics, view suspicious-request alerts, and revoke abused keys. Do not enter admin credentials into public website code.
The API is hosted by this same site. Configure the existing D1 database binding and ADMIN_TOKEN secret before managing keys. Private management routes require the secret and reject cross-origin requests.
2. Add the browser SDK
Load the hosted SDK, then use your key that was registered for the exact HTTPS origin of the current website.
<script src="https://luarn.pages.dev/api-sdk.js?v=132" defer></script>
Local processing — recommended
const result = await LuaRNAPI.obfuscate(luaSource, {
apiKey: "lrn_pub_YOUR_KEY",
filename: "script.lua"
});
LuaRNAPI.download(result);
Lua source stays in the visitor’s browser. The API authorization endpoint receives the public key and usage metadata only. Create a separate origin-bound key for each website that uses LuaRN.
3. API reference
Endpoints and operating model.
LuaRNAPI.obfuscate(source, options)Processes locally after a successful authorization; source is not sent to the API.
GET /v1/health · POST /v1/authorizePublic health endpoint and origin-bound authorization. Public keys are not admin secrets.
/v1/admin/keys · /v1/admin/analyticsPrivate admin endpoints, gated by a server-side ADMIN_TOKEN secret.
dailyLimit / expiresAtEach key can have its own daily quota and optional expiration. Expired keys are denied and automatically revoked by the scheduled cleanup.
Traffic analytics are retained for 30 days and store request metadata, not Lua source or raw IP addresses. Origin-bound public keys are intended for normal browser integrations; non-browser clients can forge Origin headers. The browser engine currently loads an LZMA module from esm.sh, so a strict site Content Security Policy must allow the LuaRN host and esm.sh.