Integration Snippets

Copy-paste examples for the validation API.

Integration Snippets

There is no SDK. Your script talks to the REST API directly. These snippets are the starting point for any executor or language. If you want a maintained drop-in client that does all of this for you, see the reference client.

Minimal check (pseudo-code)

POST /api/v1/key/check
  header X-Project-Key: pk-...
  body   { key, hwid, nonce }

if status 200:
  verify signature over nonce_echo | hwid | expires_at_unix | project_id
  if valid -> run script
else:
  read { error, message } and exit

Hardware ID

HWID is passthrough — Vampauth only compares equality. The quality of the fingerprint is on you. A single weak value is easy to spoof, so combine several signals into one fingerprint:

• Persisted storage — Roblox offers per-machine storage that survives the session (e.g. rblxanalytics-backed storage). Store a random identifier there once and reuse it; this is stable across sessions and hard to reset from the script alone.
• Executor fingerprint — your executor (Synapse, Wave, etc.) exposes APIs or memory patterns that are unique to the current install. Hash whatever is available.
• Runtime signals — things an attacker would have to reproduce exactly: platform, executor version, Roblox client build, display resolution, locale.

Mix them, then obfuscate so a forger cannot read which parts matter:

local storage = rblxanalytics_storage_get("vampauth_hwid") -- persisted per machine
if not storage then
  storage = random_id()
  rblxanalytics_storage_set("vampauth_hwid", storage)
end

local raw = storage
  .. "|" .. tostring(executor_api and executor_api.get_install_id() or "")
  .. "|" .. gethwid()          -- executor-provided machine id, when available
  .. "|" .. platform          -- e.g. "windows"
  .. "|" .. tostring(game:GetService("GuiService"):GetScreenResolution().X)

local hwid = sha256(raw) -- single opaque string to send as "hwid"

Encrypt or key-hash the combined string so the forger cannot strip out individual signals:

• sha256(raw) — simple, opaque, but the inputs are still guessable.
• hmac(raw, secret_key) — a secret baked into your script (and obfuscated) makes the fingerprint worthless without the key.
• encrypt(raw) — a real cipher over the concatenated fields; reversing it requires the key.

Keep the fingerprint stable across calls for the same machine, and regenerated if the user’s hardware/executor changes. Vampauth never sees the components — just the final string.

Nonce

A nonce is a random value you generate once per call. The server never stores it — it only echoes it back (nonce_echo) and includes it in the signature payload (sha256(nonce|hwid|expiresAtUnix|project_id)).

• Any string works, up to 128 characters.
• It must be fresh and random on every call. This is what makes replay protection work: if an attacker captures a valid response, the client’s next call uses a different nonce, so the captured signature no longer verifies.
• The client must check that nonce_echo matches the nonce it sent (and the signature verifies) before trusting the response.

A nonce that is reused or predictable defeats the whole mechanism — an attacker can replay a captured valid response unchanged.

curl

curl -X POST https://vampauth.com/api/v1/key/check \
  -H "X-Project-Key: pk-..." \
  -H "Content-Type: application/json" \
  -d '{"key":"DP3P-YDMA-NJDI-HJJC","hwid":"my-hwid","nonce":"abc123"}'

Follow the contract

• Authentication
• key/check
• Signature verification