Complete guide to using Hide.lat products and services
← Back to Home | DashboardThe Standalone Auth API allows you to implement key-based authentication for your external projects. This is perfect for monetizing applications, games, or services outside of Hide.lat's script ecosystem.
Standalone Auth is available for Premium and Deluxe plan users. Upgrade your plan to access this feature.
| Parameter | Type | Required | Description |
|---|---|---|---|
api_key |
string | Yes | Your project's API key (found in Auth Manager) |
key |
string | Yes | The user's license key to validate |
Success Response (200):
{
"success": true,
"message": "Key valid",
"expires_at": "2024-12-31T23:59:59.000Z",
"time_left": 2592000
}
Error Response (403):
{
"error": "Invalid or banned key"
}
400 - Missing required parameters403 - Invalid API key, banned key, expired key, or project disabledimport requests
def check_key(api_key, user_key):
url = "https:
data = {
"api_key": api_key,
"key": user_key
}
response = requests.post(url, json=data)
result = response.json()
if result.get("success"):
print("Key is valid!")
return True
else:
print(f"Error: {result.get('error')}")
return False
# Usage
if check_key("AUTH-XXXXXXXX", "KEY-XXXXX"):
# User is authenticated
print("Access granted")
else:
# User is not authenticated
print("Access denied")
exit()
async function checkKey(apiKey, userKey) {
const response = await fetch('https:
method: 'POST',
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify({
api_key: apiKey,
key: userKey
})
});
const result = await response.json();
if (result.success) {
console.log('Key is valid!');
return true;
} else {
console.error('Error:', result.error);
return false;
}
}
const isValid = await checkKey('AUTH-XXXXXXXX', 'KEY-XXXXX');
if (isValid) {
} else {
}
local function checkKey(apiKey, userKey)
local response = game:HttpGet("https:
["Content-Type"] = "application/json"
}, {
api_key = apiKey,
key = userKey
})
local result = game:GetService("HttpService"):JSONDecode(response)
if result.success then
print("Key is valid!")
return true
else
warn("Error: " .. result.error)
return false
end
end
-- Usage
local isValid = checkKey("AUTH-XXXXXXXX", "KEY-XXXXX")
if isValid then
-- Grant access
else
-- Deny access
end
using System;
using System.Net.Http;
using System.Text;
using Newtonsoft.Json;
public class AuthChecker
{
private static readonly HttpClient client = new HttpClient();
public static async Task<bool> CheckKey(string apiKey, string userKey)
{
var payload = new
{
api_key = apiKey,
key = userKey
};
var json = JsonConvert.SerializeObject(payload);
var content = new StringContent(json, Encoding.UTF8, "application/json");
var response = await client.PostAsync("https:
var result = await response.Content.ReadAsStringAsync();
var data = JsonConvert.DeserializeObject<dynamic>(result);
if (data.success == true)
{
Console.WriteLine("Key is valid!");
return true;
}
else
{
Console.WriteLine($"Error: {data.error}");
return false;
}
}
}
bool isValid = await AuthChecker.CheckKey("AUTH-XXXXXXXX", "KEY-XXXXX");
if (isValid)
{
}
else
{
}
The Ad Gateway system allows users to complete advertisements in exchange for temporary access keys. This is perfect for monetizing free access to your projects.
https:
- After completing ads, users receive a temporary key
https:
The Ad Gateway feature requires a Deluxe plan and proper Work.ink API configuration on the server.
In your project settings, you can configure:
Hide.lat provides powerful script obfuscation for Lua scripts, perfect for protecting your Roblox scripts and other Lua-based projects.
We now offer Luraph obfuscation for Premium and Deluxe users, providing industry-leading protection for your scripts.
| Plan | Obfuscation Type | Monthly Limit | Extra Credits |
|---|---|---|---|
| Free | Prometheus (Basic) | Unlimited | N/A |
| Premium | Luraph (Advanced) | 3/month | $2.50/each |
| Deluxe | Luraph (Advanced) | 10/month | $2.50/each |
If you've used all your monthly Luraph obfuscations, you can purchase additional credits:
After obfuscating a script, you'll receive a loadstring. Use it like this:
-- If key system is enabled:
_G.script_key = "YOUR-KEY-HERE"
loadstring(game:HttpGet("https:
-- If no key system:
loadstring(game:HttpGet("https:
Manage keys for both script obfuscation and standalone auth projects.
You can perform bulk operations on multiple keys at once:
Set up Discord webhooks to receive notifications when keys are used or scripts are executed.
Discord webhooks are available for Premium and Deluxe plan users.
Manage API keys for third-party services like Work.ink, LootLabs, and Linkvertise. These keys are stored securely and used for gateway operations and integrations.
Never share your API keys. These keys are used to authenticate with third-party services and should be kept confidential.
LootLabs allows you to create monetized redirect links with anti-bypass features. Users must complete advertisements before accessing your target URL.
| Parameter | Type | Required | Description |
|---|---|---|---|
title |
string | Yes | Link title (max 30 characters) |
url |
string | Yes | Target URL to redirect to |
tier_id |
integer | Yes | Ad tier (1-4): 1=Trending, 2=Gaming, 3=Profit Max, 4=Max Profit |
number_of_tasks |
integer | Yes | Number of ads (1-5) |
theme |
integer | No | Theme (1-5): 1=Classic, 2=Sims, 3=Minecraft, 4=GTA, 5=Space |
thumbnail |
string | No | Thumbnail image URL or YouTube link |
{
"success": true,
"link": {
"title": "My Link",
"url": "https:
"loot_url": "https:
"short": "xxxx"
},
"id": "link-id"
}
You must fill in your mandatory creator details in the LootLabs panel before the API will work. Visit LootLabs Creator Panel
Linkvertise anti-bypass extends your target links with a hash parameter that must be verified on your backend to prevent bypassing advertisements.
?hash=HASH_VALUE parameter"TRUE" - Hash was found and deleted (valid)"FALSE" - Hash could not be found (invalid or expired)"Invalid token." - Authentication token is incorrect
app.get('/your-target', async (req, res) => {
const hash = req.query.hash;
if (!hash) {
return res.status(403).send('Missing hash parameter');
}
const token = 'YOUR_LINKVERTISE_TOKEN';
const verifyUrl = `https:
try {
const response = await fetch(verifyUrl, { method: 'POST' });
const result = await response.text();
if (result === 'TRUE') {
res.send('Access granted!');
} else {
res.status(403).send('Access denied');
}
} catch (error) {
res.status(500).send('Verification failed');
}
});
Our own anti-bypass system allows you to generate and verify hashes for your target URLs, similar to Linkvertise but fully controlled by you.
{
"target_url": "https:
}
{
"hash": "f836af77649b195e92aaf46fd7aa397993a6fe985a03289f98beae12c267f9f3",
"expires_at": "2024-01-01T12:00:10.000Z"
}
{
"hash": "f836af77649b195e92aaf46fd7aa397993a6fe985a03289f98beae12c267f9f3",
"api_key": "YOUR_USER_ID_OR_API_KEY"
}
{
"valid": true
}
Hashes expire after 10 seconds, just like Linkvertise. They can only be verified once and are deleted after successful verification.