Your GUI is just a shell: it asks the GrieferHub server whether the player may run the script, shows the key link, then downloads and runs the script. The whole scheme: your GUI → /checkkey → /script → the script runs. You never store keys or code — everything stays on GrieferHub.

Where to get the parameters

The whole flow in 4 steps

Ready-to-paste loader example (Lua)

A complete minimal loader built with our GHUI window library + the API. Replace DOMAIN and PID — that is all.

-- 1) our window library
local HttpService = game:GetService("HttpService")
local API  = "https://secret.griefer.world/api/v1"
local PID  = "ab12cd34"   -- pid вашего скрипта
local HWID = tostring(game.Players.LocalPlayer.UserId)

local function getJSON(url)
    local ok, res = pcall(function() return game:HttpGet(url) end)
    if not ok then return nil end
    local ok2, data = pcall(function() return HttpService:JSONDecode(res) end)
    return ok2 and data or nil
end

local UI = loadstring(game:HttpGet("https://secret.griefer.world/library/raw/ghui"))()
local Window = UI:CreateWindow({ Title = "My Loader" })
local Tab = Window:CreateTab("Key")
local KeyInput = Tab:CreateInput({ Title = "Your key", Placeholder = "KEY-..." })

-- 2) the key-system link, copied to clipboard
Tab:CreateButton({
    Title = "Get Key (copy link)",
    Callback = function()
        local info = getJSON(API .. "/getkey?pid=" .. PID)
        if info and info.key_link and setclipboard then
            setclipboard(info.key_link)
        end
    end,
})

-- 3) check the key and load the script
Tab:CreateButton({
    Title = "Check & Load",
    Callback = function()
        local q = "?pid=" .. PID .. "&hwid=" .. HWID .. "&key=" .. KeyInput:Get()
        local data = getJSON(API .. "/checkkey" .. q)
        if data and data.success and data.status == "valid" then
            local code = game:HttpGet(API .. "/script" .. q)
            loadstring(code)()
        end
    end,
})

-- heartbeat every 3 minutes while the script runs
task.spawn(function()
    while true do
        task.wait(180)
        getJSON(API .. "/heartbeat?pid=" .. PID .. "&hwid=" .. HWID .. "&key=" .. KeyInput:Get())
    end
end)

You do not have to upload a script just to get a pid. Create a project in your profile — the pid and the key system work instantly. Integrate your GUI with the API, then upload the Lua code whenever you are ready: it is stored and served by GrieferHub, /script hands it out after a key check exactly like for regular uploads.

Created on your profile (⚙ API tab). Pass it as the X-API-Token: gh_live_... header or the &token=gh_live_... parameter. Without a token — 60 requests/min per IP, with a token — 300/min, plus every call is logged in your profile. A revoked or unknown token → 401.

GET/api/v1/info

Public script metadata (no auth): name, author, key requirement, price, online count.

{
  "success": true, "status": "ok",
  "script": { "pid": "ab12cd34", "name": "My Script", "use_key": true,
               "price": 0, "visibility": "public", "online": 3,
               "updated_at": 1725000000.0, "author_id": "123..." }
}

GET/api/v1/getkey

Key-system link for the "Get Key" button in your GUI.

{
  "success": true, "status": "ok",
  "key_link": "https://link-center.net/...",
  "key_url": "https://secret.griefer.world/get-key?pid=ab12cd34"
}

Possible statuses: no_key_system (keys off for this script).

GET/api/v1/checkkey token

The core call for third-party GUIs: is this hwid allowed to run the script with this key? Respects private scripts (whitelist). The response is signed with an HMAC.

{
  "success": true, "status": "valid", "message": "Key is valid",
  "expires_at": 1725086400.0,   -- unix time the key expires (or null)
  "expires_in": 86400,          -- seconds until expiry
  "online": 3,                  -- players in game right now (via heartbeat)
  "script_version": 1725000000, -- unix time of the last script update
  "sig": "0af31c..."            -- HMAC-SHA256(secret, "pid:hwid:expires_at"), first 32 chars
}

GET/api/v1/script token

The script code itself — the same obfuscated payload the built-in loader receives. Success — text/plain with Lua code, error — JSON. Every unique hwid counts one load per 24 hours.

GET/api/v1/heartbeat

A "script is alive" ping every few minutes while it runs. Anti key-sharing: one key can be live on one device at a time — a second device gets key_in_use (403) while the first one stays silent for over 30 minutes. Returns the online player count.

{
  "success": true, "status": "ok",
  "session": "same",   -- new | same | took_over
  "online": 3,
  "expires_in": 86400,
  "sig": "0af31c..."
}

GET POST/api/v1/report

Crash/error report from your GUI — lands in the GrieferHub admin panel.

Responses of /checkkey and /heartbeat contain a sig field = the first 32 chars of HMAC-SHA256 over the string "pid:hwid:expires_at" keyed with the project secret. The secret is shown to the author on the script edit page ("Developer API secret" block). This lets your GUI verify the answer really came from the GrieferHub server and was not spoofed.

-- Lua (executors with crypt):
local expected = crypt.hmac.crypt(crypt.base64encode("pid:hwid:" .. tostring(expires_at)), secret)
-- compare the first 32 chars with the data.sig field

Where do I find my pid?
Open your script page in the catalog. The link looks like /script?pid=ab12cd34 — ab12cd34 is your pid.

Do I have to use the key system?
If the key system is switched off for the script, /checkkey works without the key parameter — just pass hwid.

What is the token for?
It is optional. Without it — 60 requests/min per IP; with it — 300/min and a call log in your profile. Create it in the ⚙ API tab of your profile.

checkkey says invalid_key but the key looks correct
A key is bound to the Roblox account (hwid) that received it. A different account = invalid_key by design — that is what stops key sharing.

Can I start using the API before uploading my script?
Yes — use "Create Project" in your profile. You get a pid instantly and the whole /api/v1 key flow works. The Lua code is uploaded to GrieferHub afterwards (Edit page) and is served by /script like any other script.

• The API is completely free — paid tiers and paid tokens do not exist.
• Without a token — 60 requests/min per IP, with a token — 300/min per token (429 when exceeded).
• Keys, purchases and access fully mirror the built-in loader rules — the API has no separate logic.
• A token is not your account password: it only identifies your requests. Do not publish it.
• For your GUI take a ready-made library from the GUI Library — our GHUI SDK gives you CreateWindow, tabs and buttons in one line.
• The administration may disable the API entirely — then all endpoints answer 503 api_disabled.
• Questions and extended limits — the GrieferHub Discord community.