Create a Key System

A key system is the whitelist behind your Roblox script: it validates license keys, binds HWIDs, delivers your protected build, and logs every execution to a Discord webhook. You build and manage one entirely in the Key Systems tab of the client area at quarkexploits.com — there is no download and nothing to host.

Everything on this page happens in your browser. The website hosts the database and API and is the single source of truth, so anything you save is instantly live at your loader endpoint. The steps below take you from an empty tab to a raw loader id you can hand to buyers, plus the api_secret that authenticates API access to your system.

Before you start

Have these ready so you don't have to stop halfway through creation:

A signed-in Quark account — activate a QRK-XXXXX-XXXXX-XXXXX key (or use your username and password) and complete Discord verification, which the whole client area requires. See Sign in & Setup.
The script source you want to protect and deliver (plain Luau).
A Discord webhook URL for the channel where executions should be logged (optional, but recommended).

Step 1 — Open the Key Systems tab

Sign in at quarkexploits.com and complete Discord verification if you have not already. Then open the Key Systems tab from the client area.

You'll see any existing key systems on your account and a button to create a new one. Because the site is the single source of truth, everything you do here is written straight to the shared database and takes effect at your loader endpoint immediately.

Step 2 — Create the system

Choose New Key System and give it the details below.

Field	What it is
Name	A label for this system so you can tell it apart from your others. Internal only.
Webhook URL	The Discord webhook the server calls to log executions. It is stored server-side and never appears in code the buyer can see. You can add or change it later.

Each key system is independent. If you run several scripts, create one key system per script — each gets its own raw loader id, its own api_secret, and its own pool of license keys. A key issued under one system is meaningless to another.

Step 3 — Save your loader id and api_secret

When you create the system the server assigns it a raw loader id (the ID in your https://quarkexploits.com/raw/ID.lua URL) and generates an api_secret. The api_secret is the credential that authenticates API access to this key system. It is displayed a single time, so copy it immediately and store it somewhere safe.

You cannot view the api_secret again after this screen. If you lose it you will have to rotate it from the key system settings. Copy it now, before you do anything else, and keep it out of screenshots, your repo, and any channel your buyers can see.

Step 4 — Paste your script source

With the system created, paste the real Luau source you want to protect into the script field. This is the code that will ultimately run inside the buyer's executor. It is stored server-side and is never exposed at a public URL — the loader only ever returns a protected build after a valid key + HWID check.

The obfuscator is Luau-only and is behavior-preserving: your logic runs exactly as written. Write normal Luau; you do not need to change your code to make it compatible.

Step 5 — Choose an obfuscation tier

On publish, Quark runs your source through the same server-side Obfuscator that powers the client-area tool. Pick how hard your delivered script is to reverse. There are two families of protection:

Source-based tiers — Standard, Strong, Maximum, and Hyper transform your source with ChaCha20 encryption, control-flow flattening, and ciphertext fragmentation. Hyper is the strongest source tier.
Quantum — a per-build VM tier. Instead of encrypting your source it compiles your script to a custom opcode set, so a dump yields opcodes rather than readable Luau. It is hard-gated (falling back to Hyper if it cannot guarantee a construct) and every output is verified in a real Luau VM before delivery.

Tier	Method	Resists dumping?
Standard / Strong / Maximum	Source encryption + control-flow flattening + fragmentation	Raises effort; ultimately dumpable
Hyper	Strongest source-based build	Raises effort; ultimately dumpable
Quantum	Compiles to a per-build custom VM / opcode set (falls back to Hyper if it can't guarantee a construct)	Dump yields opcodes, not source — the real defense

Honest limit: any source-based tier can eventually be dumped by a determined attacker who hooks load() and peels the layers back to readable source — a fundamental property of running code inside an executor, not a Quark flaw. Nothing running inside an executor is truly unbreakable; your protection is the combination of server-gated delivery, the HWID lock, and logging, with Quantum raising the dump bar to reverse-engineering a custom VM. See the full breakdown on the Obfuscator & Tiers page.

Step 6 — Publish and get your loader

Choose Publish. The platform obfuscates your source at the tier you selected and serves it behind a raw loader URL of the form:

https://quarkexploits.com/raw/ID.lua

Give buyers the loader snippet below. They set script_key to their own license key and paste it into their executor:

script_key = "THEIR-LICENSE-KEY"
loadstring(game:HttpGet("https://quarkexploits.com/raw/ID.lua"))()

Replace ID with your key system's loader id. When this runs, the loader stub reads the global script_key (and aborts if it is missing), collects the HWID plus player/game/hardware info, and POSTs it to /api/v1/loader/auth. The server validates the key and HWID, binds the HWID on first run and rejects any different HWID afterward (this is the anti‑key‑sharing check), then returns your obfuscated script and fires your Discord webhook server-side. Because the webhook fires on the server, its URL is never in code the buyer can see.

Deep-dive on the request flow, the checks the server runs, HWID binding, and denial reasons lives on the The Loader & Delivery page.

Managing license keys

A key system is only useful once it has keys. From the Key Systems tab you can generate a single random key, add a specific manual key, or bulk-generate thousands at once, then hand the values to your buyers. Each license carries a status and an optional expiry:

Create — issue random, manual, or bulk keys for the selected system.
Expiry — set a date for a timed key, or leave it blank for a lifetime key. Once the date passes, the key moves to expired and the loader stops returning the script.
HWID lock — the key binds to the buyer's machine on first execution and rejects any other machine after that. Clear a bind with a HWID reset from the dashboard (subject to a cooldown that stops a sharer from resetting on every run).
Pause / revoke — a paused key is a reversible hold; a banned key is a permanent revoke that keeps the value on record so it can never be reused.

See The Loader & Delivery for exactly how the server checks a key's status and HWID on every run, and the denial reasons a buyer can hit.

Discord webhook logging

Every authorized execution fires the Discord webhook you configured for the system — from the server, not the buyer's machine. This is deliberate and more trustworthy than logging from the client would be:

The webhook URL is stored server-side, so it never appears in any code the buyer can see, extract, or spam.
A server-fired log reflects what the server actually authorized, so it cannot be blocked, faked, or stripped out by whoever controls the machine.

You get a running record of who ran what and when, consistent with the license state behind it.

Updating a system

Because the website is the single source of truth, you can change the source, re-publish at a different tier, adjust the webhook, and manage keys at any time. Re-publishing refreshes the obfuscated build served at your existing raw URL, so your buyers do not need a new loader snippet.

Deleting a system

Deleting a key system removes its raw loader file. The https://quarkexploits.com/raw/ID.lua endpoint stops serving, so every loader that points at it will fail immediately — buyers will no longer receive the script. It also invalidates the api_secret for that system.

Only delete a system when you genuinely want to retire it. If you just want to stop specific users, pause or ban their individual licenses instead of deleting the whole system.

Recap

Sign in to the client area, verify Discord, and open the Key Systems tab.
Create a system: give it a name and (optionally) a webhook URL for execution logging.
Copy the api_secret — it is shown only once — and note your raw loader id.
Paste your Luau source.
Choose an obfuscation tier (source-based Standard–Hyper, or the Quantum VM).
Publish to get the raw URL and hand buyers the script_key loadstring snippet.
Generate and manage licenses from the same tab.

Need help? Join the community on Discord.