Documentation

Bastion protects your Lua scripts with Luraph and gates them behind a key system. Create a project, upload a script, generate keys for your users, then hand them a one-line loader.

1. Create a project in the dashboard.
2. Upload one or more scripts (each tied to a Game ID).
3. Generate keys (users) for your buyers.
4. Share your project's loader URL — see below.

Each project has a single loader URL. The buyer pastes their key and the loader, and Bastion automatically serves the right script for whatever game they're in — no Game ID in the link.

script_key = "YOUR_KEY_HERE"
loadstring(game:HttpGet("https://bastiondev.org/api/loader/project/<publicId>"))()

The loader is obfuscated and cached on our edge. Replace<publicId>with your project's public ID (shown on the project's custom-loader screen).

Once authenticated, these globals are available inside your script. They mirror common whitelist variables, prefixed with BST_. For compatibility, the equivalent Luarmor LRM_ names (e.g. LRM_IsUserPremium, LRM_SecondsLeft) are also set, so scripts written for Luarmor run unmodified.

if BST_Premium then
    print("Welcome back, premium user!")
    print("Your key expires in " .. BST_Expiry .. "s")
end

Bastion runs your scripts through Luraph, so Luraph's LPH_ macros work out of the box. Write them in your source and they're processed automatically at upload — no extra configuration.

On the v15 node you can also tune protection per function with the attributes system. Make LPH_ATTRIBUTES the first statement of a function body to set its VM, preset, optimization or encryption — for example LPH_ATTRIBUTES(VM(NONE)) to keep a hot path un-virtualized, or PRESET(SECURE) to push security higher. Child functions inherit a parent's attributes unless they set their own.

local secret = LPH_ENCSTR("my-secret-token")

if not LPH_OBFUSCATED then
    -- only runs in your raw source, never in the protected build
    LPH_CRASH()
end

Wrap a function in BST_INIT to run it before the protected code is authenticated — for a "enter your key" GUI, or an anti-cheat bypass that has to land before anything else. The function is pulled out at upload and served raw, ahead of the obfuscated loader, so treat it as public: put no secrets in it. For compatibility, LRM_INIT_SCRIPT works as an alias.

To show an async key prompt, block at the end of the function until the key is set — otherwise the loader continues and fails authentication. Assign the entered key to the global script_key. Code that doesn't need to wait (a bypass) can just run inline.

BST_INIT(function()
    local UI = loadstring(game:HttpGet("https://your-key-ui"))()

    local done, entered = false, nil
    UI:AddInput({ Title = "Enter a key", OnSubmit = function(key)
        entered = key
        done = true
    end })
    UI:Show()

    -- Block until the key is entered, then hand it to the loader.
    while not done do task.wait() end
    script_key = entered
end)

Automate keys and projects from your own bot or backend. Generate an API key in Account and send it as a bearer token:

curl https://bastiondev.org/api/v1/keys \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "projectId": "...", "count": 1, "durationDays": 30 }'

• Auth: every request needs Authorization: Bearer <key>. The key is shown once at generation — store it safely.
• Rate limits: per-minute, by tier (Basic 60, Pro 120, Master 300). Responses carry X-RateLimit-Remaining and a 429 with Retry-After when exceeded.
• IP allowlist: optionally restrict your key to specific IPs or CIDR ranges in Account. Requests from anywhere else are rejected.

Limits scale with your plan. Upgrade any time by redeeming an invite code in your account.

Need higher limits? Open a ticket in our Discord for enterprise pricing.