BlackLeach API Documentation

Validate license keys, bind them to a stable HWID, and optionally return a short-lived protected Lua/Luau loader.

Validation endpoint

Send a POST request to https://blackleach.xyz/api/validkey.

Authentication

Include a project-scoped key in X-BlackLeach-API-Key, or send the same value as an Authorization bearer token.

Request body

{
  "keysystem_id": "YOUR_KEYSYSTEM_ID",
  "key": "USER_LICENSE_KEY",
  "hwid": "DEVICE_OR_EXECUTOR_HWID",
  "include_script": false
}

Response behavior

A successful validation returns valid: true and the license expiry. When protected delivery is requested, it also returns fresh loader metadata. Invalid, expired, revoked, wrong-project, and HWID-mismatched keys return valid: false.

Next steps

Create an account, create a keysystem, then generate a project API key in the dashboard.