Quick start
- Sign in with Discord and open Protect code.
- Name the project, select the source language, then paste your source or upload a text file. The source limit is 2 MB;
.txt,.lua, and.luauare supported. - For Luau, select Veil Luau. Enable License key enforcement if recipients must have a key.
- Select Protect and create release. Keep a backup of your original source.
- For a licensed release, generate a key in License keys and replace the loader's key placeholder. Test your own release in its intended environment before distribution.
Uploaded source is compiled for protection. Successful compilation is not a guarantee of runtime compatibility or script safety.
Loader integration
A loadstring fetches the current protected release. Copy the loader from your project's details; keep the project identifier intact.
script_key = "YOUR-LICENSE-KEY"
loadstring(game:HttpGet("https://aegis-code.dev/files/v4/loaders/PROJECT_ID.lua"))()Use this only in an environment you are authorized to run scripts in, with the required HTTP and loadstring support. For a project without key enforcement, use the exact keyless loader generated by the site.
Opening a loader URL in a browser displays a copyable loader preview. It does not execute the script. Publishing a new version updates the release served at the existing URL.
For JavaScript or Python, copy the language-specific loader supplied by Aegis. A Luau loadstring is not interchangeable with those loaders.
Public Get Key
Project owners configure public access in Projects → project details → Public key system. New projects start with issuance off. Existing enabled Linkvertise projects keep their configuration and their original access links.
- Choose Off, Free — no ad gate, or Linkvertise — verified visit required, and set the key lifetime.
- For Linkvertise, create a Link target using the displayed Aegis key-page URL, enable Anti-Bypass, and save the published link and authentication token. The token stays on the server.
- Enable List this project in the public Get Key catalog only if you want its name and access page shown at /get-key. Listing is off by default, including for existing projects. An unlisted, enabled page still works through its direct link.
- Save, then share the access-page link. Public keys consume the same workspace key allowance as keys generated in the dashboard or bot.
Recipients do not need an Aegis account. Free mode has no ad check. Linkvertise mode requires server-confirmed completion: an unavailable or rejected gate issues no key. A catalog listing is not a safety review or endorsement.
One confirmation can issue at most one key. Retrying a completed request returns the same active key, including after a server restart; simultaneous requests cannot create additional keys from that confirmation. A free access session lasts 10 minutes. Linkvertise result recovery is available for up to 24 hours. Save the key and loader before leaving the page.
If a request times out, retry it on the same page before starting a new visit. A consumed confirmation cannot be reused to mint another key. After a failed gate, changed settings, or a quota rejection, resolve the issue with the project owner before completing a fresh visit.
IP addresses and optional basic browser characteristics are stored as keyed hashes for abuse prevention, with automatic deletion after 30 days. Owners and Aegis administrators can inspect truncated hashes in Public key security activity. Issuance history remains after those signals are deleted. A browser fingerprint is a risk signal, not proof of identity.
Public issuance currently creates ordinary project licenses. Unified device binding across anonymous keys and every delivery path is not yet available; current HWID binding applies to Discord activations.
Key Check API
Check a key without executing the release. No Aegis account session is required; possession of the full license key authorizes this check.
GET https://aegis-code.dev/api/runtime/PROJECT_ID/check
X-License-Key: YOUR-LICENSE-KEYPOST to the same endpoint is also supported. Prefer the X-License-Key header over a URL query parameter, which may be stored in request history.
const response = await fetch("https://aegis-code.dev/api/runtime/PROJECT_ID/check", {
headers: { "X-License-Key": licenseKey }
});
if (!response.ok) throw new Error("License check unavailable");
const result = await response.json();
if (result.valid !== true) throw new Error(result.reason || "License rejected");A successful response includes valid: true, project.id, project.name, and license fields: status, uses, maxUses, durationHours, activatedAt, expiresAt, and variables. Timestamps are Unix milliseconds; unset limits or dates can be null.
| HTTP status | Meaning |
|---|---|
| 200, valid: true | The key currently passes the check. |
| 200, valid: false | Read reason: KEY_REQUIRED, LICENSE_REJECTED, KEY_INACTIVE, KEY_EXPIRED, or USAGE_LIMIT_REACHED. |
| 429 | Too many requests. Wait before retrying. |
| 5xx / network error | Verification is unavailable. Do not treat this as permission to run. |
Checking a key does not consume a use or start its hourly timer. This endpoint currently checks license state, not device binding. Runtime delivery performs its own checks. Never use a client-side check alone to protect a server-side action.
Optional AEGIS_VARS runtime values can be configured in the workspace. They are delivered to the recipient; do not put server secrets in them.
Discord commands
Install the bot from Settings → Discord, connect the project's Discord Server ID, and keep the bot's role above the roles it manages. Role assignment requires Manage Roles.
| Command | Purpose |
|---|---|
/panel project:NAME | Publish a project's buyer control panel. |
/key project:NAME amount:5 hours:24 | Generate private license keys; omit hours for Lifetime access. |
/whitelist user:@buyer project:NAME hours:24 | Create and assign project access to a Discord member. |
/blacklist user:@buyer project:NAME | Revoke that member's project license. |
/botadmin add|remove|list | Manage trusted bot staff; requires Manage Server. |
/help | View command and permission information. |
The buyer panel offers Redeem Key, Get Script, Get Role, Reset HWID, and Get Stats. Staff commands are available to Manage Server holders, delegated bot administrators, and the Aegis Admin / FOR PAYMENT roles. Grant those roles only to trusted people.
Frequently asked questions
Is the protection unbreakable?
No. Veil increases the work needed to inspect a script. A person controlling the execution environment may inspect, copy, dump, or reconstruct its logic.
Can I upload a .txt file?
Yes. Select the correct source language and upload a UTF-8 text file within the 2 MB limit.
Does Aegis test my script's behavior?
Compilation is not a behavior or safety review. Test the generated release in your intended environment.
When does hourly access start?
New hourly keys begin their timer on first successful execution, not when generated or checked with the Key Check API. Existing explicitly dated keys follow their stored expiration.
What does Lifetime mean?
The key has no scheduled expiration. It remains subject to revocation, project availability, usage limits, and the service terms.
Can I update the source without changing the loader?
Yes. Publish a new version through the project's version controls. The existing loader URL resolves the current release.
What is HWID binding?
It associates supported license delivery with a device identifier. Currently this binding is attached to Discord activations. A client-supplied HWID can be spoofed; it is a best-effort access control, not a hardware identity guarantee.
How do I change devices?
For a Discord-activated key, use Reset HWID in the buyer panel. A cooldown may apply. Contact the project owner if access is still unavailable.
Can a buyer get a key without signing into Aegis?
Yes, when the project owner enables a public key page. Follow the owner's published access link and its required steps. Public issuance is separate from purchasing an Aegis workspace plan.
Does an Aegis plan buy access to every script?
No. Workspace plans cover protection and license-management limits. Access to a particular script is controlled by its project owner.
How are Litecoin payments activated?
Submit the transaction ID and Discord contact through Billing. A claim remains pending until the owner checks and approves the payment. A submitted TxID alone does not prove receipt.
Can I request a refund?
See the Refund Policy and contact support with your transaction reference. Eligibility depends on the actual purchase and applicable terms.
Can I put webhook URLs or API secrets in the script?
Do not distribute server secrets, bot tokens, or private webhook tokens. Obfuscation cannot guarantee their secrecy once sent to a client.
Does revoking a key erase a delivered copy?
No. Access controls can restrict later deliveries; they cannot recall code already received or stop arbitrary copies running outside the service's control.
What happens if I exceed my plan?
Creation is limited by your current entitlements. Check Billing for available capacity; upgrading or reducing inventory may be necessary. Existing data is not automatically deleted just because a paid period expires.
Troubleshooting
- Key rejected: confirm the project, full key, status, expiration, and remaining uses with the project owner.
- HWID mismatch: use the Discord panel's reset action for a Discord-activated license, then retry on the intended device.
- Linkvertise verification failed: complete the required visit again. If verification is unavailable, wait; an unavailable gate must not issue a key.
- Bot cannot assign roles: check Manage Roles and the role hierarchy. Check that the project is connected to this exact server.
- Compilation fails: review the reported source location and selected language. Reduce the example to isolate unsupported code.
- Network error or 429: stop repeated submissions, wait, and retry. Do not repeatedly execute a script that is freezing the runtime.
Send support the project reference, error text, and time of failure. Exclude full keys, tokens, session cookies, and source you are not authorized to share. Contact support.