API documentation

1. Base URLs

There are two hosts, and they do different jobs:

All requests and responses are JSON. Send Content-Type: application/json on anything with a body.

2. Authentication

Two credentials are involved, and mixing them up is the most common mistake: your API key is 52 characters and identifies your account, and it is exchanged for a short-lived session token that every other endpoint expects. The API key itself is never sent as a bearer token.

curl -X POST https://solauth.cc/auth/key-login \
  -H "Content-Type: application/json" \
  -d '{"apiKey":"YOUR_52_CHARACTER_API_KEY"}'

{
  "token": "eyJhbGciOiJIUzI1NiIs…",
  "username": "rayen",
  "apiKey": "YOUR_52_CHARACTER_API_KEY",
  "apiKeyHint": "…f3a9",
  "plan": {
    "tier": "pro",
    "name": "Pro",
    "active": true,
    "lifetime": false,
    "expiresAt": 1793404800000,
    "daysLeft": 24,
    "limits": {
      "tier": "pro",
      "projects": 3,
      "scripts": 15,
      "scriptsPerProject": 15,
      "keys": 500,
      "priority": false
    }
  }
}

Send the token as a bearer token on every other request:

Authorization: Bearer eyJhbGciOiJIUzI1NiIs…

When a token stops working

Tokens are re-checked against the account on every request, not just at issue, so a token can die before it expires. It stops working when the account is banned, and when the API key is rotated. Both cases come back as 401: treat any 401 as "log in again", not as a bug.

3. Errors

Every failure is JSON with an error string. Some carry a stable code as well — prefer matching on that rather than on the message, which is written for people and may be reworded.

{ "error": "Your PRO plan allows 3 projects. Upgrade to add more.", "code": "PLAN_LIMIT" }

Nothing is deleted when a plan lapses. A 402 blocks creating things; reading what you already have keeps working.

4. Projects

A project groups scripts and their keys, and owns the HWID-reset cooldown that applies to its buyers. Deleting one cascades: its scripts and their keys go with it, and that is not reversible.

[
  {
    "id": "kQ2m8xVa1pLz",
    "userId": "u_7fd3…",
    "name": "Aurora Hub",
    "hwidResetCooldownMs": 3600000,
    "created_at": 1786579200000,
    "scriptCount": 4,
    "keyCount": 128,
    "execCount": 1284,
    "ownerName": "rayen"
  }
]

5. Scripts

A script belongs to one project and carries its own access mode. Source is never returned by the list endpoint — content is stripped from every row.

{ "id": "8fq2xk", "disabled": true }

6. Keys

Two different keys exist and they are not interchangeable — the length is the tell:

• A redeem key is 32 characters. This is what these endpoints mint, and what you sell or hand out. It is redeemed exactly once.
• A loader key is 16 characters. The buyer gets it when they redeem, and it is the value that goes in getgenv().sol_key.

curl -X POST https://solauth.cc/scripts/8fq2xk/keys \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"count":50,"note":"october batch"}'

7. Whitelist

The whitelist maps a Discord user to the projects they may run, and holds the access key their device locks against. You only ever see entries that grant access to your projects.

{
  "268473198094811136": {
    "discordId": "268473198094811136",
    "discordUsername": "rayen",
    "note": "bought 12 Oct",
    "projectIds": ["kQ2m8xVa1pLz"],
    "accessKey": "GtbEFJQgnEfZEHih",
    "addedAt": 1786579200000,
    "addedBy": "rayen"
  }
}

{ "ok": true, "nextResetAt": 1786582800000, "cooldownMs": 3600000, "resetCount": 1, "escalated": false }

{ "error": "Reset on cooldown.", "retryAt": 1786582800000, "retryInMs": 2841000, "cooldownMs": 3600000, "resetCount": 3 }

8. The loader

This is the only part your buyers touch, and the only part that talks to api.solauth.cc. Copy it from the dashboard — every script's row carries its own, already filled in.

getgenv().sol_key = "GtbEFJQgnEfZEHih"
loadstring(game:HttpGet("https://api.solauth.cc/loader/8fq2xk"))()

The first line is the buyer's 16-character loader key; the second is the loader URL for that script. On a script set to free access the first line is dropped and only the loadstring remains.

Everything is decided server-side. A run that fails any check — revoked key, wrong device, disabled script, killed build — never receives the build.

9. Plan limits

The API enforces the same allowances shown on the pricing section. Going over one returns 402 with code: "PLAN_LIMIT".

Read your own live figures from plan.limits on /auth/key-login or /auth/me rather than hard-coding them. A null limit means unlimited — no current tier uses one, but the field still allows it, so handle it. Security features, the Discord bot and API access are on every tier — only the allowances differ.

10. Notes & conventions

• All timestamps are milliseconds since the Unix epoch, as numbers.
• IDs are opaque strings. Don't parse them or assume a length.
• Deletes return { "success": true }. Deleting something that was already gone is a 404, not a success.
• Only browser navigations to unknown paths are walled off. API calls from a script or from curl are unaffected.
• There is no API versioning yet. Changes are additive where possible; this page is updated with the API.