Version 1

API Documentation

Use the SimpleObfuscator API to obfuscate Lua files from your bots, build pipelines, CLI tools, or any application that speaks HTTP. Every response contains standard headers and status codes so integration is straightforward.

Base URL: https://simpleobfuscator.app

Getting started

1. Create an account. Sign up with your email at /auth.
2. Generate an API key. Open your Dashboard and click New API key. Copy the key immediately — it will not be shown again.
3. Call the API. Send your Lua source in the request body and receive the obfuscated file as the response.

Authentication

All requests must include an API key. Send it in the X-API-Key header. Alternatively you can send it as a bearer token using the Authorization header.

http

X-API-Key: sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# or
Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys can be revoked at any time from the Dashboard. Revoked keys immediately return 403.

Endpoints

Method	Path	Purpose
POST	/api/public/v1/obfuscate	Obfuscate a Lua file.

POST /api/public/v1/obfuscate

Send your Lua source and receive the obfuscated file as the response body. Two request styles are supported:

1. Raw Lua body

Set Content-Type: text/plain and put your Lua source in the request body.

http

POST /api/public/v1/obfuscate HTTP/1.1
Host: simpleobfuscator.app
X-API-Key: sk_live_...
Content-Type: text/plain

print("hello, world")

2. Multipart file upload

Send a multipart/form-data body with a single field named file.

bash

curl -X POST https://simpleobfuscator.app/api/public/v1/obfuscate \
  -H "X-API-Key: sk_live_..." \
  -F "file=@script.lua" \
  -o script_obfuscated.lua

Successful response

On success, the API returns 200 OK with the obfuscated Lua source as the raw response body. Metadata is exposed in headers:

http

HTTP/1.1 200 OK
Content-Type: text/x-lua; charset=utf-8
Content-Disposition: attachment; filename="script_obfuscated.lua"
X-Input-Bytes: 32
X-Output-Bytes: 18432
X-Elapsed-Ms: 41
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59

return(function(...)local __="This file was generated using SimpleObfuscator v1.0.1"; ...

Error codes

Errors are returned as JSON with an error code and a message.

json

{ "error": "invalid_api_key", "message": "Unknown API key." }

Status	Error	Meaning
400	empty_source	Request body is empty.
400	missing_file	multipart body did not include a 'file' field.
400	invalid_body	Body could not be read.
401	missing_api_key	No X-API-Key header was sent.
401	invalid_api_key	The API key does not exist or is malformed.
403	revoked_api_key	The API key has been revoked.
413	file_too_large	Input exceeds the 1 MB size limit.
429	rate_limited	Hourly rate limit exceeded for this key.
500	obfuscation_failed	The obfuscator encountered an internal error.

API limits

Rate limit: 60 requests per hour per API key. Remaining quota is exposed via X-RateLimit-Remaining.
Max input size: 1,000,000 bytes (1 MB) per request.
Accepted content types: text/plain, text/x-lua, and multipart/form-data.

Code examples

JavaScript / Node.js (fetch)

javascript

import { readFile, writeFile } from "node:fs/promises";

const source = await readFile("script.lua", "utf8");

const res = await fetch("https://simpleobfuscator.app/api/public/v1/obfuscate", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.SIMPLE_OBFUSCATOR_KEY,
    "Content-Type": "text/plain",
  },
  body: source,
});

if (!res.ok) {
  const err = await res.json();
  throw new Error(`${err.error}: ${err.message}`);
}

const obfuscated = await res.text();
await writeFile("script_obfuscated.lua", obfuscated);
console.log("Done in", res.headers.get("X-Elapsed-Ms"), "ms");

Python (requests)

python

import os, requests

with open("script.lua", "rb") as f:
    source = f.read()

resp = requests.post(
    "https://simpleobfuscator.app/api/public/v1/obfuscate",
    headers={
        "X-API-Key": os.environ["SIMPLE_OBFUSCATOR_KEY"],
        "Content-Type": "text/plain",
    },
    data=source,
    timeout=30,
)

if resp.status_code != 200:
    raise RuntimeError(resp.json())

with open("script_obfuscated.lua", "wb") as out:
    out.write(resp.content)

print("remaining:", resp.headers.get("X-RateLimit-Remaining"))

Go (net/http)

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
    "os"
)

func main() {
    src, _ := os.ReadFile("script.lua")

    req, _ := http.NewRequest("POST",
        "https://simpleobfuscator.app/api/public/v1/obfuscate", bytes.NewReader(src))
    req.Header.Set("X-API-Key", os.Getenv("SIMPLE_OBFUSCATOR_KEY"))
    req.Header.Set("Content-Type", "text/plain")

    resp, err := http.DefaultClient.Do(req)
    if err != nil { panic(err) }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    if resp.StatusCode != 200 {
        fmt.Println("error:", string(body)); return
    }
    _ = os.WriteFile("script_obfuscated.lua", body, 0644)
}

cURL

bash

curl -X POST https://simpleobfuscator.app/api/public/v1/obfuscate \
  -H "X-API-Key: $SIMPLE_OBFUSCATOR_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @script.lua \
  -o script_obfuscated.lua

Ready to integrate?