FAQ & Troubleshooting

Fast answers to the questions and errors that come up most often when running a Quark key system, from loader errors your buyers hit to a Discord bot that will not come online.

One rule underpins almost everything below: the website is the single source of truth. The database and API live on quarkexploits.com, and the desktop software, the loader, and the Discord bot are all clients of it. If something looks out of sync, confirm what the website shows first, then check the client.

Loader errors your buyers see

When a buyer runs the loader in their executor, the stub reads the global script_key, collects HWID and player/game/hardware info, and POSTs to /api/v1/loader/auth. The server validates the key and the HWID before it returns the obfuscated script. Most buyer-side problems surface as one of the errors below.

ErrorWhat it meansHow to fix it
invalid-keyThe script_key in the loader does not match any license on this key system, or the key belongs to a different key system.Check for typos, stray spaces, or missing quotes around the key. Confirm the license actually exists and is active in the dashboard. Make sure the buyer is using the loader URL for the correct key system.
hwid-mismatchThe key is already bound to one machine and is now being run from a different HWID. This is the anti key-sharing check working as designed.If the buyer legitimately changed or reset their PC, reset the HWID (see below). If you did not expect a second machine, the key may be shared — investigate before resetting.
expiredThe license reached its expiry date, or its status is no longer active(paused, banned, or expired).Renew or re-activate the license from the dashboard. A license with no expiry is lifetime and should never report this — if it does, check the status field.

The missing-key case

If nothing happens at all, the buyer most likely pasted the loader without setting the key. The stub aborts immediately when the global script_key is missing. The loader must look exactly like this, with the key line above the loadstring call:

script_key = "THEIR-LICENSE-KEY"
loadstring(game:HttpGet("https://quarkexploits.com/raw/YOUR-ID.lua"))()

A common mistake is deleting or renaming the script_key line, or wrapping the key in the wrong quotes. The key must be assigned to the global named exactly script_key, as a string, before the loadstring runs.

How to reset a buyer HWID

HWID binds to the first machine that executes the key. To move a key to a new machine you clear that binding so the next run rebinds fresh. There are two ways:

1
From the Discord bot. The buyer runs /reset. This command has a cooldown to stop abuse, so it may refuse if used too recently. This is the self-service path most owners prefer.
2
From the dashboard. Open the license on the website and reset its HWID there. This has no cooldown and is the right tool when you are helping a buyer directly or overriding a cooldown.

After a reset, the very next execution binds the key to whatever machine runs it — so make sure the buyer runs it on the machine they intend to keep using.

Bot is offline or commands do not appear

Remember the model: there is one bot process per key system, it is a Node application you host yourself, and it must stay running. If it is offline in Discord, the process has stopped or was never started.

1
Is the process actually alive? The bot must run somewhere that keeps a Node process up — Railway, a VPS, or Pterodactyl. If you ran it on your own PC and closed the window, it is down. Check your host's logs for a crash.
2
Check the .env. The bot needs BOT_TOKEN,CLIENT_ID, GUILD_ID, API_BASE, KEY_SYSTEM_ID, and API_SECRET. A wrong or regenerated BOT_TOKEN keeps the bot from logging in at all. Remember API_SECRET is shown once at key-system creation — if you lost it, you cannot read it back.
3
Commands missing? Slash commands are registered with yourCLIENT_ID (the Application ID). If commands never show up, confirmCLIENT_ID is the correct Application ID and that you invited the bot with theapplications.commands scope in addition to bot. Guild command registration usually appears quickly; a fresh global sync can take longer.
4
Permissions. The bot needs Manage Roles, Manage Channels, and Send Messages. Missing permissions can make it look broken even when it is online — it cannot grant the buyer role or open ticket channels. Also make sure its role sits above the buyer role it hands out.

Commands you toggle in the software auto-sync to the bot. If you turned a command off in the Key System tab, it will not appear in Discord — that is expected, not a bug.

The bot left my server

This is intentional. Each bot locks itself to a single server and will automatically leave any other server it is added to. If your bot keeps leaving, theGUILD_ID in its .env does not match the server you invited it to.

1
Copy the correct server (guild) ID from Discord — enable Developer Mode, right-click the server, and Copy Server ID.
2
Set that exact value as GUILD_ID in the bot's .env, and confirm it matches the Discord server (guild) id you set on the key system in the software.
3
Restart the bot, then re-invite it to the intended server. It will stay in the one whose ID it holds and leave the rest.

Is my script safe?

The honest answer: nothing running inside an executor is truly unbreakable, and Quark does not pretend otherwise. What you get is layered protection — server-gated delivery, an HWID lock, and logging — plus a real choice of obfuscation strength.

The source-based tiers — Standard, Strong, Maximum, and Hyper — use ChaCha20 encryption, control-flow flattening, and ciphertext fragmentation. Hyper is the strongest source tier. But any source-based obfuscation can eventually be dumped by a determined attacker who hooks load() and peels the layers back to readable source. That is a fundamental limit of source-based protection, not a flaw specific to Quark.

The Quantum tier is different in kind. It compiles your script to a custom VM and opcode set, so an attacker who dumps the output gets opcode numbers, not readable Luau. That is the real defense against the dump attack. Quantum is hard-gated: if it cannot guarantee a construct, it refuses and falls back to Hyper, and every output is verified by running it in a real Luau VM before it ships. All tiers execute 100% correctly — Quantum raises the bar from “peel the layers” to “reverse-engineer a custom VM,” which is a far larger job.

The strongest posture is Quantum for the payload plus the structural protections that do not depend on obfuscation at all: the real source is never in a public URL, the server only returns it after validating key and HWID, and every request is logged. Deobfuscation is staff/owner only.

The download is blocked by SmartScreen

Quark is a native Windows desktop app. Windows SmartScreen commonly warns on newly released or less-common installers regardless of what they do. If you see a “Windows protected your PC” prompt, click More info and then Run anyway to continue. Only do this with the installer you downloaded from quarkexploits.com — do not run a build from anywhere else.

Where does my data live?

The database and API live on the website — the Next.js app hosted on Vercel at quarkexploits.com. That is the single source of truth. The desktop software, the loader, and the Discord bot are all clients that read from and write to it, so anything you edit in one place syncs to all three. Two related notes on where things are stored:

Pricing and account limits

Quark is $2/month or $5 lifetime. The one limit tied to plan type is in the Account Manager: monthly-key users can add up to 5 accounts, while lifetime and staff accounts are unlimited. Multi-Roblox lets you run several accounts at once within that cap.

Where do I get help?

For anything not covered here — setup questions, edge-case errors, or account issues — join the community Discord: https://discord.gg/AvfJCzRgUz. Deobfuscation and other sensitive actions are staff/owner only, so open a ticket there rather than sharing keys or cookies in public channels.