1. Create your own API key
Anyone can create a key for their own HTTPS website without an administrator token. The portal gives you a public API key, a private key-management token, and a ready-to-paste official embed snippet. Your management token controls only your own key.
Public customers can manage their own quota or revoke their own key. The private ADMIN_TOKEN remains reserved for LuaRN site administration and analytics.
2. Add the LuaRN SDK
Load the hosted SDK, then use your key that was registered for the exact HTTPS origin of the current website.
<div id="luarn-api-widget"></div>
<script src="https://luarn.pages.dev/api-sdk.js?v=140" defer data-luarn-widget data-luarn-brand="LuaRN Obfuscator" data-luarn-target="#luarn-api-widget" data-luarn-api-key="lrn_pub_YOUR_KEY"></script>
Server-side processing — engine stays private
const result = await LuaRNAPI.obfuscateRemote(luaSource, {
apiKey: "lrn_pub_YOUR_KEY",
filename: "script.lua",
includeAntiTamper: true
});
LuaRNAPI.download(result);
Lua source is sent to LuaRN over HTTPS for in-memory processing. The server engine and templates are bundled privately and are not shipped to client websites. Create a separate origin-bound key for each website that uses LuaRN.
3. API reference
Endpoints and operating model.
LuaRNAPI.obfuscateRemote(source, options)Sends Lua over HTTPS to the private server engine. Requires a valid public API key registered for the website origin.
data-luarn-widget + data-luarn-api-keyCreates a copy-paste widget automatically; no inline JavaScript is required.
GET /v1/health · POST /v1/authorizePublic health endpoint and origin-bound authorization. Public keys are not admin secrets.
POST /v1/keys · GET/PATCH/DELETE /v1/keysSelf-service key creation and owner-token management. Global analytics remain admin-only.
dailyLimit / expiresAtEach key can have its own daily quota and optional expiration. Expired keys are denied and automatically revoked by the scheduled cleanup.
Traffic analytics are retained for 30 days and store request metadata, not Lua source or raw IP addresses. Public keys are visible in website code by design; they are restricted by origin and quota, not treated as secret credentials. Non-browser clients can forge Origin headers, so quotas and server-side monitoring still matter. The server engine and private templates are bundled into the Worker rather than served as assets.