luast

Base URL

https://luast.clv.cloud

Authentication keep this secret

loading…

Header: Authorization: Bearer <token>. Regenerate token

Endpoints

POST/api/v1/obfuscate
POST/api/v1/obfuscate/batch
POST/api/v1/optimize
GET/api/v1/versions

Request body

`code`	string	Luau source. required
`preset`	string	`level1` / `level2` / `level3` / `none`. Defaults to `level3` (or `none` when `enable` is given without a preset).
`enable`	string[]	Pass ids to force on over the preset.
`disable`	string[]	Pass ids to turn off over the preset.
`options`	object	Per-pass settings: `rate` 0-1 (`string_encrypt`, `buffered_consts`), `cache` (`string_encrypt`), `unique_table` (`tabled_consts`).
`outputStyle`	string	`compact` (default) / `pretty` / `singleline`. Optimize ignores it (always pretty).
`version`	string	Engine version, like `1.0.2`. Defaults to the latest.

Passesstring_encryptremove_namecall environment_integrity opaque_variables hash_compare scramble_tables flatten_control_flow buffered_consts tabled_consts unique_table_per_func scramble_upvalues minify_vars junk_code scramble_globals. Unknown ids in enable/disable are skipped and listed in warnings; a bad rate is a 400.

environment_integrity is on by default on Levels 2–3. Pro can turn it on or off.

VersionsGET /api/v1/versions lists the versions you can pass as version, so a script keeps getting the output it was tested with. Older versions don't return applied. GET /api/v1/presets?version=1.0.2 lists that version's presets and passes.

Free and Supporter: presets, string-encryption and namecall controls, plus the string_encryptrate & cache and tabled_constsunique_table options. Environment integrity and full pass control require Pro.

Limits

Free	5 / 24h	Inputs up to 4 MB. Presets and basic controls.
Supporter	30 / 24h	No input size cap.
Pro	unlimited	No input size cap, full pass control, and the batch endpoint.

Obfuscation counts are a rolling 24 hours, shared between the site and the API. Over the limit, /api/v1/obfuscate returns 429 with an error that says when the next run frees up. A request that fails validation doesn't count. Optimize is unlimited for everyone. A separate per-minute rate limit also answers 429.

Response

`result`	string	The transformed Luau.
`elapsed_ms`	number	Server processing time.
`id`	string	Run id. Include it in feedback so the input can be attached.
`applied`	object	Settings used (obfuscate only): `preset`, enabled `passes`, `options`, and `environmentIntegrity` (`true` if on, `false` if off).
`warnings`	string[]	Present only when non-empty.
`error`	string	Error message on failure; `result` is empty.

applied.environmentIntegrity tells you whether environment integrity is on. If your settings prevent it, warnings explains why. No warning is added for Level 1 or when you deliberately turn it off.

{
  "result": "-- obfuscated Luau …",
  "elapsed_ms": 42,
  "id": "req_…",
  "applied": {
    "preset": "level3",
    "passes": ["opaque_variables", "hash_compare", "remove_namecall", "scramble_tables", "flatten_control_flow", "string_encrypt", "buffered_consts", "tabled_consts", "scramble_upvalues", "minify_vars", "junk_code", "scramble_globals"],
    "options": { "string_encrypt": { "rate": 1, "cache": false }, "buffered_consts": { "rate": 1 }, "tabled_consts": { "unique_table": false } },
    "environmentIntegrity": true
  }
}

Example (matches your current settings)

…

Batch Pro

POST /api/v1/obfuscate/batch requires Pro (other tiers get 403). It takes a scripts array. Top-level preset / outputStyle / enable / disable / options act as defaults; any field on an item overrides them. version is top-level only and applies to the whole batch. Results return in request order; a failed item comes back with ok:false and never blocks the others. Each item also has the per-request size limit.

scripts array One object per script (code required; optional name echoed back, plus per-item configuration overrides). required

Returns { ok, count, succeeded, elapsed_ms, results: [ { index, name, ok, result, seed, elapsed_ms, warnings, applied } ] } - each item carries the same applied manifest as the single endpoint, or an error in place of result when it fails.

…

luastsuite

Samples