1. Secure API management
Open the separate administrator console protected by Cloudflare Access. Use it to create keys, set daily quotas and expiry, inspect traffic analytics, view suspicious-request alerts, and revoke abused keys. Do not enter admin credentials into public website code.
The Worker deployment package must be installed and Cloudflare Access configured before the new console is available. Public API endpoints remain separate from private management routes.
2. Add the browser SDK
Load the hosted SDK, then use your key that was registered for the exact HTTPS origin of the current website.
<script src="https://luarn.pages.dev/api-sdk.js?v=130" defer></script>
Local processing — recommended
const result = await LuaRNAPI.obfuscate(luaSource, {
apiKey: "lrn_pub_YOUR_KEY",
filename: "script.lua"
});
LuaRNAPI.download(result);
Optional server-side processing
const result = await LuaRNAPI.obfuscateRemote(luaSource, {
apiKey: "lrn_pub_YOUR_KEY",
filename: "script.lua"
});
Local mode keeps the Lua source in the visitor’s browser. Server mode sends source to the Worker and requires per-key enablement, a Worker environment flag, and sufficient CPU allowance.
3. API reference
Endpoints and operating model.
LuaRNAPI.obfuscate(source, options)Processes locally after a successful authorization; source is not sent to the API.
LuaRNAPI.obfuscateRemote(source, options)Optional server processing; uploads source to the Worker and returns generated Lua.
GET /v1/health · POST /v1/authorizePublic health endpoint and origin-bound authorization. Public keys are not admin secrets.
POST /v1/obfuscateOptional server-side transformation; requires a key with server processing enabled and a configured Worker CPU plan.
/v1/admin/keys · /v1/admin/analyticsPrivate admin endpoints, gated by Cloudflare Access and a validated Access JWT.
dailyLimit / expiresAtEach key can have its own daily quota and optional expiration. Expired keys are denied and automatically revoked by the scheduled cleanup.
Traffic analytics are retained for 30 days and store request metadata, not Lua source or raw IP addresses. Origin-bound public keys deter casual browser misuse, but an HTTP Origin can be forged outside normal browsers. No obfuscator can guarantee that code is never dumped after runtime reconstruction.