Documentation Overview

Quark is a Roblox script protection and licensing platform: a native Windows app, a website that holds the database and API, and an optional Discord bot — three clients around one source of truth.

What Quark is

Quark lets you sell and protect Roblox scripts. You obfuscate your source, hand buyers a tiny loader stub instead of the real code, gate every execution behind a license key and a hardware lock, and log who runs what. The real script is never sitting in a public URL — it is delivered only after the server validates the request.

There are three moving parts, and they are all wired to the same backend:

The software — a native Windows desktop app written in Rust. This is where you create key systems, generate and manage licenses, obfuscate and publish scripts, and manage Roblox accounts. It is a client of the website API.
The website — this Next.js app running on Vercel at quarkexploits.com. It hosts the database and the API, serves the raw loader URLs, validates key + HWID on every run, and is the single source of truth.
The Discord bot — an optional Node process, one per key system, that lets your buyers redeem keys, reset their HWID, open tickets, and check status from inside your Discord server. It is also a client of the website API.

One source of truth

The website owns the data. The software and the bot do not keep their own separate copies — they read from and write to the same API. That means a change made in any one place shows up in all three: pause a license in the desktop dashboard and the bot will refuse to redeem it; toggle a bot command in the software and the running bot picks up the change; a HWID reset run with the bot's /reset is the same reset you would do from the dashboard. There is no import/export step to keep straight — edit once, and it syncs everywhere.

Practical upshot: you can run your whole operation from the desktop app and let the bot handle day-to-day buyer self-service, and the two never drift out of sync because neither one is the authority — the website is.

The loader flow, step by step

This is the core of how Quark protects a script. A buyer never receives your source — they receive a loader stub that fetches the protected script at runtime, and only after the server approves the request. Here is what happens on every execution.

The buyer pastes this into their executor:

script_key = "THEIR-LICENSE-KEY"
loadstring(game:HttpGet("https://quarkexploits.com/raw/ID.lua"))()

The loader stub reads the global script_key. If it is missing, the stub aborts immediately — no key, no request.

The stub collects the machine's HWID plus player, game, and hardware information, and POSTs it to /api/v1/loader/auth on the website.

The server validates the key and the HWID. On the very first run for a key, it binds that key to the HWID that ran it. On later runs, a different HWID is rejected — this is the anti key-sharing lock: one key runs on one machine.

If everything checks out, the server returns the obfuscated real script. If not, it returns nothing usable. The real source is never exposed in a public URL — it only travels in an approved response.

The server fires a Discord webhook from its own side, so the webhook URL never appears in any code the buyer can see. You get a log of the execution without leaking anything.

In one line: key present → info collected → POST to the API → key + HWID validated (bind on first run, reject a new HWID after) → obfuscated script returned → webhook logged server-side.

Protection: how far it actually goes

Quark stacks several defenses: server-gated delivery (the script only arrives after validation), the HWID lock (a key can't be shared to another machine), execution logging, and obfuscation of the script itself. It is worth being honest about what each layer can and cannot do.

The source-based obfuscator tiers — Standard, Strong, Maximum, and Hyper (Hyper is the strongest source tier) — use ChaCha20 encryption, control-flow flattening, and ciphertext fragmentation. They run 100% correctly and they raise the effort bar a lot, but any source-based obfuscation can eventually be dumped by a determined attacker who hooks load() and peels the layers off. That is a fundamental limit of running code inside someone else's executor, not a Quark-specific flaw.

The Quantum tier is different in kind: it compiles your script to a custom VM with its own opcode set, so dumping the output yields opcode numbers rather than readable source. That is the real answer to the dump attack. Quantum is hard-gated — if it cannot guarantee a construct will run correctly, it refuses and falls back to Hyper — and every Quantum output is verified by running it in a real Luau VM before you get it.

Nothing running inside an executor is truly unbreakable. The honest framing is that Quark's protection is server-gated delivery plus the HWID lock plus logging, with Quantum raising the dump bar to reverse-engineering a custom VM. Deobfuscation is restricted to staff and owners.

Which page do I want?

I want to...	Go to
Set up my first key system and understand the fields it needs	Key Systems guide
Generate, add, bulk-create, pause, ban, or expire licenses	Licenses guide
Choose an obfuscator tier and publish a script to get its raw loader URL	Obfuscation & Publishing guide
Create the Discord app, invite the bot, and fill in its .env	Discord Bot guide
Understand what the loader does and troubleshoot a failed auth	Loader & Auth guide
Add Roblox accounts by cookie and run several at once	Account Manager guide
See pricing and account limits	Pricing guide

The main guides

Key Systems — create a key system in the software's Key System tab: name, Discord guild id, buyer role id, webhook URL, bot token, and a ticket category. You receive an api_secret once, on creation — save it, it goes in the bot's .env.
Licenses — generate a random key, add a manual key, or bulk-generate thousands. Statuses are active, paused, banned, and expired; no expiry means lifetime. HWID binds on first execution and can be reset.
Obfuscation & Publishing — the Standard/Strong/Maximum/Hyper source tiers versus the Quantum VM tier, and how publishing obfuscates your source and returns the raw loader URL.
Discord Bot — one bot per key system, locked to a single server. Create the app in the Discord Developer Portal, invite it with the right scopes and permissions, and configure its .env. Covers /panel, /redeem, /reset, and the rest.
Loader & Auth — the loader stub, the /api/v1/loader/auth call, and how key + HWID validation decides what comes back.
Account Manager — add real Roblox accounts via the .ROBLOSECURITY cookie (encrypted at rest with Windows DPAPI), launch straight into a game, and run Multi-Roblox.

A few things to know up front

One bot per key system. The bot locks itself to a single Discord server and leaves any other server automatically. If you run multiple key systems, you run multiple bot processes.
The api_secret is shown once. When you create a key system you get it a single time. If you lose it, you cannot fish it back out of the dashboard — plan to store it in the bot's .env right away.
Account limits depend on your plan. Monthly-key users can add up to 5 Roblox accounts in the Account Manager; lifetime and staff accounts are unlimited.
Commands sync from the software. Toggling a bot command in the desktop app updates the running bot — you do not redeploy the bot to change which commands are on.

Pricing is $2/month or $5 lifetime. Questions, or want to see it in action? Join the community Discord: discord.gg/AvfJCzRgUz.