Luafly Docs

Luafly Documentation

Luafly is a script protection platform for Roblox developers. Upload your Lua script, get a protected loader, and manage who can run it — all from one dashboard. Users are whitelisted by HWID and can only access your script after redeeming a key you generate.

Who is this for	What you do
Script developers	Sign up, upload scripts, generate keys, manage users and logs
End users	Get a key from the developer, redeem it, then run the loader

Luafly is free for up to 3 scripts. Upgrade to Premium (100 Robux gamepass) for unlimited scripts.

How it works

The full flow from uploading a script to a user running it.

1

Developer uploads a script

You paste your Lua script into the dashboard. Luafly stores it and generates a unique protected loader URL for it.

2

Developer generates a key

From the Keys tab, generate a one-time use key (7 day, 30 day, or lifetime) and give it to the user.

3

User redeems the key

The user runs the redeem script with their key. Their HWID is automatically registered and they are marked as whitelisted.

4

User runs the loader

Every time the user wants to run the script, they use the loader. Luafly checks their HWID — if whitelisted, the script loads. If not, they get kicked.

The script source is never exposed. Users only ever see the loader — the actual content is fetched and executed server-side after HWID verification.

Signing up

Luafly uses Discord OAuth — no passwords, no email. Just click Login with Discord and you're in.

1

Go to luafly.is-local.org

Click Login with Discord on the landing page.

2

Authorize with Discord

Allow Luafly to read your Discord username and ID. That's all it asks for.

3

You're in

Your account is created automatically. You start on the free tier with up to 3 scripts.

Uploading a script

From the Scripts page, fill in a name, optional description, then paste your full Lua script content and click Upload.

Free accounts can upload up to 3 scripts. Upgrade to Premium for unlimited.

Once uploaded, your script card appears on the Scripts page showing:

Element	What it is
Script name	The name you gave it
Active badge	Whether the script is currently being served
Loader preview	The one-liner users run to load your script
Copy loader button	Copies the loader to your clipboard instantly
Delete button	Permanently deletes the script and all its users, keys, and logs

Script detail tabs

Clicking a script card opens the detail view with four tabs.

Tab	What it shows
Users	All whitelisted and blacklisted users for this script. Add, edit, or delete users.
Keys	Generate and manage one-time use whitelist keys for this script.
Logs	Execution history for this script — filter by today, this week, or all time.
Lua Scripts	The redeem script to give to new users for this specific script.

Each script has its own isolated users, keys, and logs. A user whitelisted for one script is not whitelisted for another.

Managing users

Users are added automatically when they redeem a key, or manually from the Users tab. Each user record contains:

Field	Description
hwid	Hardware ID from RbxAnalyticsService — unique per device
username	Roblox username, auto-filled on key redemption
status	whitelisted, blacklisted, or expired
ban_reason	Shown in the kick message when blacklisted
notes	Private notes only visible in your dashboard
hwid_resets_left	Number of HWID resets remaining
tokens	Reset token balance
executor	Auto-detected executor name when they run the loader
last_seen	Last successful execution timestamp

Click Edit on any user row to update their status, ban reason, notes, resets, or tokens. You can also delete them from the edit modal.

Blacklisting a user kicks them with the ban reason shown in-game. If no reason is set it defaults to "No reason provided."

Keys

Keys let you give someone access without manually entering their HWID. Generate them from the Keys tab inside a script.

Keys are one-time use. Once redeemed the key is consumed and cannot be reused. Generate a new key for each person.

Duration	Access period
7day	Expires 7 days after the user redeems it
30day	Expires 30 days after the user redeems it
lifetime	Never expires

You can generate up to 50 keys at once. Each key follows the format LUAFLY-XXXXXXXXXXXXXXXX.

The Keys tab shows each key's status — Available or Redeemed — and the HWID of whoever redeemed it.

Logs

Every significant action is logged per script and visible from the Logs tab.

Action	When it's logged
executed	A whitelisted user successfully loads the script
redeemed key	A user redeems a key and gets whitelisted

Filter logs by Today, This week, or All time. Each log entry shows the username, HWID, action, and timestamp.

Webhook

Set a Discord webhook URL in Settings to get notified every time someone runs one of your scripts. The webhook fires on every successful execution across all your scripts.

1

Create a webhook in Discord

Go to your Discord server → channel settings → Integrations → Webhooks → New Webhook. Copy the URL.

2

Paste it in Settings

Go to Settings in your Luafly dashboard, paste the URL under Webhook, and click Save Webhook.

Each webhook message shows the script name, username, executor, and HWID of whoever ran it.

Make sure the webhook_url column exists in your Supabase accounts table. If you see a schema error when saving, add the column (type: text) in Supabase Table Editor.

Premium

The free tier allows up to 3 scripts. Premium removes that limit entirely.

Tier	Scripts	Price
Free	Up to 3	Free
Premium	Unlimited	100 Robux gamepass

1

Buy the gamepass on Roblox

Find the Luafly Premium gamepass (100 Robux) and purchase it on your Roblox account.

2

Verify in the dashboard

Go to the Premium tab in your dashboard, enter your Roblox username, and click Verify purchase. Luafly checks your gamepass ownership via the Roblox API and upgrades your account instantly.

Redeeming a key (end users)

If you received a key from a script developer, run the redeem script they gave you. It will look like this — just replace the placeholder with your actual key before running.

lua
-- Replace with the key the developer gave you (no local keyword)
key = "LUAFLY-XXXXXXXXXXXXXXXX"
loadstring(game:HttpGet("https://luafly.is-local.org/api/redeem/LOADER_ID_HERE?key=" .. key .. "&hwid=" .. game:GetService("RbxAnalyticsService"):GetClientId() .. "&username=" .. game.Players.LocalPlayer.Name))()

The developer gives you the exact script to run — you don't need to build it yourself. Just replace the key value and run it once.

After running you should see Successfully redeemed! You are now whitelisted. in the console. The key is now used up — don't share it, it won't work for anyone else.

Make sure you use key = without local so the variable is accessible inside the loadstring.

Running the loader (end users)

After redeeming your key, run the loader the developer gave you every time you want to use the script. It checks your HWID and loads the script automatically.

lua
-- The loader the developer gives you looks like this
loadstring(game:HttpGet("https://luafly.is-local.org/api/load/LOADER_ID_HERE?hwid=" .. game:GetService("RbxAnalyticsService"):GetClientId() .. "&executor=" .. (identifyexecutor and identifyexecutor() or "Unknown")))()

The loader only works from inside a Roblox game. Opening the URL in a browser returns access denied — this is intentional to protect the script source.

Whitelist statuses

When you run the loader, one of the following outcomes happens based on your whitelist status.

Status	What happens
whitelisted	Script loads successfully
blacklisted	Kicked — ban reason shown in the kick message
not found	Kicked — your HWID is not in the whitelist. Redeem a key first.
expired	Kicked — your whitelist period ended. Contact the developer for a new key.

If you get kicked for suspicious activity it means your HWID triggered the brute-force protection (10+ failed attempts). Contact the developer to get it cleared.