API Documentation

Integrate Syntexx obfuscation into your projects via our REST API.

Authentication

All API requests require an API key. Generate one from your dashboard after signing in. Pass the key via the Authorization header or X-API-Key header.

Authorization: Bearer stx_your_api_key_here

Obfuscate Script

POST https://syntexx.pages.dev/api/v1/obfuscate

Send Lua/Luau source code and receive the obfuscated result. All responses include the --[( Protected by Syntex.of.to )]-- watermark.

Minimal Request

curl -X POST https://syntexx.pages.dev/api/v1/obfuscate \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer stx_YOUR_KEY" \
  -d '{
    "code": "print(\"Hello World\")"
  }'

Full Options Request

{
  "code": "local secretKey = 0xDEADBEEF\nlocal function verify(input)\n  return input == secretKey\nend\nprint(verify(123))",
  "options": {
    "useLuaVM": true,
    "loaderVMDepth": 3,
    "encryptStrings": true,
    "proxifyLocals": true,
    "proxifyFunctions": true,
    "antiTamper": true,
    "isLuauRuntime": true,
    "controlFlowFlattening": true,
    "minify": true
  }
}

Fast AST (No VM)

{
  "code": "for i = 1, 1000 do print(i) end",
  "options": {
    "useLuaVM": false,
    "encryptStrings": true,
    "proxifyLocals": true,
    "minify": true
  }
}

Configuration Options

Option	Type	Default	Description
`useLuaVM`	boolean	true	Virtualizes Lua AST into custom LuaVM bytecode with dynamic opcode shuffling.
`loaderVMDepth`	integer	3	Nested VM layers (1 to 5). Higher depth increases protection.
`encryptStrings`	boolean	true	Encrypts and dynamically decodes all string literals at runtime.
`proxifyLocals`	boolean	true	Wraps local variables into metatable proxy containers.
`proxifyFunctions`	boolean	true	Wraps function declarations through callable proxies.
`antiTamper`	boolean	true	Injects environment verification and anti-hooking integrity checks.
`controlFlowFlattening`	boolean	true	Flattens linear execution into state-machine driven basic blocks.
`isLuauRuntime`	boolean	true	Protects against Luau deobfuscators and runtime introspection.
`minify`	boolean	true	Strips debug symbols, comments, and applies identifier mangling.

Code Examples

JavaScript / Node.js (fetch)

const response = await fetch('https://syntexx.pages.dev/api/v1/obfuscate', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer stx_YOUR_API_KEY'
  },
  body: JSON.stringify({
    code: 'print("Hello from Syntexx!")',
    options: { useLuaVM: true, loaderVMDepth: 3 }
  })
});

const data = await response.json();
if (data.success) {
  console.log('Protected code:', data.code);
} else {
  console.error('Error:', data.error);
}

Python (requests)

import requests

response = requests.post(
    'https://syntexx.pages.dev/api/v1/obfuscate',
    headers={
        'Authorization': 'Bearer stx_YOUR_API_KEY'
    },
    json={
        'code': 'print("Hello from Syntexx!")',
        'options': {
            'useLuaVM': True,
            'loaderVMDepth': 3,
            'encryptStrings': True,
        }
    }
)

data = response.json()
if data.get('success'):
    with open('protected.lua', 'w') as f:
        f.write(data['code'])
    print(f'Obfuscated! Output: {len(data["code"])} bytes')
else:
    print(f'Error: {data.get("error")}')

Roblox / Luau (HttpService)

local HttpService = game:GetService("HttpService")

local response = HttpService:RequestAsync({
    Url = "https://syntexx.pages.dev/api/v1/obfuscate",
    Method = "POST",
    Headers = {
        ["Content-Type"] = "application/json",
        ["Authorization"] = "Bearer stx_YOUR_API_KEY"
    },
    Body = HttpService:JSONEncode({
        code = "print('Hello from Syntexx!')",
        options = { useLuaVM = true, loaderVMDepth = 3 }
    })
})

if response.Success then
    local data = HttpService:JSONDecode(response.Body)
    if data.success then
        print("Protected! Size:", #data.code)
    end
end

Response Format

Success (200 OK)

{
  "success": true,
  "code": "--[( Protected by Syntex.of.to )]--\nlocal ...",
  "stats": {
    "input_bytes": 35,
    "output_bytes": 16420,
    "input_lines": 2,
    "output_lines": 2,
    "elapsed_seconds": 0.38
  },
  "logs": [
    { "level": "info", "time": "16:20:00", "message": "Analyzing script..." },
    { "level": "success", "time": "16:20:01", "message": "Build finished in 0.38s." }
  ]
}

Error Response

{
  "success": false,
  "error": "Syntax Error on line 2: ...",
  "error_details": {
    "line": 2,
    "column": 9,
    "detail": "no viable alternative at input '='",
    "suggestion": "Lua uses '==' for equality and '~=' for inequality.",
    "snippet": "..."
  }
}

Rate Limits & Usage

Each API key tracks request counts. You can monitor usage from the dashboard. Maximum 5 active API keys per account.