API

Obfuscate

POST/api/obfuscate

Send JSON. Every protection defaults to off when the field is false or missing. Sign in and the browser sends your session cookie automatically. A script or another server sends Authorization: Bearer axle_… with the key from the dashboard. A free key can obfuscate 100 times a day; the count resets at 00:00 UTC. The account must have a verified email — see Rate limits.

{
  "source": "print(1)",
  "preset": "SWIFT",
  "profile": "sunc-full",
  "generation": 1,
  "compress": "never",
  "strings": false,
  "numbers": false,
  "stripNames": false,
  "mba": "off",
  "inline": false,
  "unroll": false,
  "fastRuntime": false,
  "macros": false,
  "antiTamper": false,
  "watermark": false,
  "watermarkId": "",
  "licenseKey": false,
  "license": "",
  "serverLock": false,
  "host": "",
  "nonce": "",
  "job": "",
  "precheck": "",
  "precheckFrom": "place",
  "encfunc": ""
}

curl -X POST https://axletool.app/api/obfuscate \
  -H "authorization: Bearer axle_your_key" \
  -H "content-type: application/json" \
  -d '{"source":"print(1)","preset":"HARDENED","token":"your-16-byte-min-token"}'

Request fields

Fields map 1:1 onto axle.toml — see Presets and the compiler's config.mdx for the deeper rules each one triggers.

Core

Protection

Watermark, license, lock

Bind (HARDENED)

Empty means off. HARDENED still mints a build secret (_ak) even with every bind field empty — a token of at least 16 bytes is required to compile HARDENED at all.

Result

A 200 response is JSON with these fields, plus the usual usage counters.

Errors

Errors are JSON: {"error": "message"}. A 429 also carries the current used / limit / remaining / resetsAt.

Rate limits & email verification

Every account gets 100 obfuscations a day, counted in UTC and shared between the dashboard, the API key, and the signed-in browser session — it is one bucket per account, not per credential. The counter resets at 00:00 UTC; GET /api/me and every obfuscate response report resetsAt as an ISO timestamp.

New accounts must verify their email before /api/obfuscate will run a job, whether the call is authenticated by session cookie or by axle_… key. An unverified account gets 403 with code: "EMAIL_NOT_VERIFIED" even if a key was already issued. Changing the account email re-locks it until the new address is verified. Resend the link from the dashboard; sign-up and sign-in both trigger one automatically.

Account & auth

/api/auth/* is Better Auth (email + password, session cookies). The account routes below are specific to this site and sit beside it.

GET/api/me

Returns the signed-in account: email, name, image, emailVerified, whether a key exists (hasKey, prefix), and today's used / limit / remaining / resetsAt. 401 when signed out.

POST/api/keys

Creates the account's key, or rotates it when the body is {"rotate":true}. The full key string is only ever present in this response — the dashboard and GET /api/me only ever see the prefix.

GET/api/keys

Returns hasKey, prefix, and createdAt for the current key, without the full secret.

DELETE/api/keys

Deletes the current key. 404 if there isn't one.

POST/api/verify/send

Resends the verification email to the signed-in account. Rate-limited to one send per minute; returns {"ok": true, "emailVerified": true} immediately if the account is already verified.

POST/api/avatar

Uploads a profile photo (JPEG/PNG/WebP/GIF body, 256 KiB max after client-side crop). Returns the new image URL, versioned so it can be cached indefinitely.

DELETE/api/avatar

Removes the profile photo.

Presets

preset picks the encrypt pad and how Axle assigns native, cps, reduce, and vm per function. Default is SWIFT. HARDENED is the security tier — see the HARDENED notes in Macros & attributes and the bind fields above.

Preset-level defaults for the protection fields, before your request overlays them:

native output still strips names and encrypts strings by default — it is never plaintext Lua. antiTamper only weaves on HARDENED; SWIFT and BALANCED silently ignore the field.

Profiles

profile sets the host gate — what syntax and APIs the emit is allowed to assume. Default is sunc-full. Runtime emit never calls debug.*, getfenv, hookfunction, or loadstring; compress: "loadstring" is a wrapper around the emit, not a call inside it.

Profile-gate failures are hard 400 errors — a buffer call on unc-lite, or compress: "loadstring" on roblox-studio, fails the request rather than silently degrading.

Macros & attributes

Compile-time only — macros are fully erased from the emit, and attributes just set fields that this API's JSON body can also set directly. Both are read from the script's source text, so they travel with the script rather than the request.

Attributes

--!axl lines in the first 32 lines of source. An unknown key is a compile error. These are shorthand for the matching JSON field and are overlaid after the request body and before macros resolve, so a script can tighten a build the request left loose.

--!axl profile=sunc-full
--!axl preset=HARDENED
--!axl vm=auto
--!axl encrypt=str
--!axl inline
--!axl unroll

Macros

Prefix is AXL_. Enabled by the macros request field — with it false, these calls are left untouched as ordinary global function calls rather than expanded, and an unrecognized AXL_* name is not an error.

Luraph and MoonSec aliases

These names compile to the matching Axle action — they are not no-ops, and the emit does not fingerprint as either competitor.

There is no --!lph attribute form — use --!axl even when the macro calls themselves are the LPH_* names.

Plugins

Watermark, license lock, server lock, and the HARDENED anti-tamper check. They weave into the emit itself — not a file-prefix if block you can delete — and none of them call out over the network. Guard failure strings go through the same encrypted pool as the rest of the script, so grepping the output won't find a plaintext failure message.

Watermark

When on, emit includes local _w = "<token>" inside the IIFE (or at the top of the chunk on roblox-studio, which has no IIFE). Token order: watermarkId if set; else a composed customer.script.build.generation.seedhex string when any of those account fields are set; else 16 hex digits of the seed. The same seed and config always produce the same token — it identifies a leak, it does not stop one.

License lock

Requires license. The guard passes when rawget(_G, "_lk") or a local _lk equals that string. The license literal is run through the string-encrypt pool; a mismatch calls error with an encrypted message. Set _G._lk (or _lk) on the host before the chunk runs — there is no HTTP round trip. On HARDENED the license hash also mixes into the constant KDF, so stripping the check leaves constants undecipherable rather than just skipping a check.

Server lock

Requires host. The guard compares tostring(game.PlaceId) and tostring(game.JobId) against it. Both field names stay plaintext so the host engine can read them; the comparison string itself is encrypted. Mismatch calls error with an encrypted message, and on HARDENED the host hash mixes into the constant KDF the same way the license does.

Anti-tamper

File-overlay only on SWIFT and BALANCED — those presets accept antiTamper: true and silently ignore it, no error. On HARDENED, the guard also checks rawget(_G, "_t"): nil or 0 passes, any other planted value fails closed. That probe is mixed into the same constant KDF as the license and lock hashes and as any AXL_PRECHECK result — deleting the bind if leaves strings and numbers undecipherable rather than just removing a check. Emit never calls debug.*, getfenv, hookfunction, or string.dump; AXL_CRASH() smashes a negative-index table and then spins on a mixed error("e…") token rather than erroring cleanly.