Create a Key System

A key system is the whitelist behind your script: it validates license keys, binds HWIDs, delivers your obfuscated source, and fires Discord webhooks. You build one entirely inside the Quark software's Key System tab, and it syncs to the website API and your Discord bot automatically.

Everything on this page happens in the native Windows app. The website (quarkexploits.com) hosts the database and API and is the single source of truth, so anything you save here is instantly available to the loader endpoint and to your bot. The steps below take you from an empty tab to a raw loader URL you can hand to buyers.

Before you start

Have these ready so you don't have to stop halfway through creation:

Your Quark license key (used to sign in to the platform from the software).
Your Discord server (guild) ID and the buyer role ID you want redeemers to receive.
A Discord webhook URL for the channel where redemptions and executions should be logged.
Your Discord bot token (from the Discord Developer Portal — see the Discord Bot Setup page).
The script source you want to protect and deliver (plain Luau).

You only need one bot application for one key system. A single bot process is locked to a single server — if you invite it elsewhere it leaves that other server automatically. Set the bot up fully on the Discord Bot Setup page.

Step 1 — Open the tab and connect

Launch the Quark desktop app and open the Key System tab from the sidebar.

Connect to the platform by entering your Quark license key. This authenticates the software to the website API so any system you create is written to the shared database and reflected on the dashboard and bot.

Once connected you'll see any existing key systems on your account and a button to create a new one.

Step 2 — Create the system

Choose New Key System and fill in the fields below. Every field maps to how the server validates keys and how the bot behaves.

Field	What it is
Name	A label for this system so you can tell it apart from your others. Internal only.
Discord server (guild) ID	The numeric ID of the server this system belongs to. The bot locks itself to this guild.
Buyer role ID	The role granted to a user when they redeem a key with the bot. Give the bot Manage Roles and place its role above this one.
Webhook URL	The Discord webhook the server calls when events fire. It is stored server-side and never appears in code the buyer can see.
Bot token	The token for your Discord bot application, so the platform can drive commands and role/channel actions.
Ticket category	Where support tickets are created. Choose auto-create to have a new category made for you, or link an existing category by ID.

Getting Discord IDs

In Discord, turn on Developer Mode (User Settings → Advanced), then right-click a server, role, or category and choose Copy ID. Paste the number into the matching field. The bot token and webhook URL come from the Discord Developer Portal and a channel's integration settings respectively — both are covered on the Discord Bot Setup page.

Ticket category: if you link an existing category, make sure the bot has Manage Channels there or it won't be able to open and close ticket channels.

Step 3 — Save the api_secret (shown once)

When you create the system the server generates an api_secret and displays it a single time. This secret is how your Discord bot authenticates to the API on behalf of this key system. Copy it immediately and store it somewhere safe.

You cannot view the api_secret again after this screen. If you lose it you will have to rotate/recreate credentials. Copy it now, before you do anything else.

The api_secret goes into your bot's .env file alongside the other values the bot needs:

BOT_TOKEN=your-discord-bot-token
CLIENT_ID=your-application-id
GUILD_ID=your-server-id
API_BASE=https://quarkexploits.com
KEY_SYSTEM_ID=the-id-of-this-key-system
API_SECRET=the-secret-shown-once-at-creation

Full bot hosting and command setup lives on the Discord Bot Setup page. Commands you toggle in the software auto-sync to the running bot.

Step 4 — Paste your script source

With the system created, paste the real Luau source you want to protect into the script field. This is the code that will ultimately run inside the buyer's executor. It is stored server-side and is never exposed at a public URL — the loader only ever returns an obfuscated build after a valid key + HWID check.

The obfuscator is Luau-only and executes your logic 100% correctly. Write normal Luau; you do not need to change your code to make it compatible.

Step 5 — Choose an obfuscation tier

Pick how hard your delivered script is to reverse. There are two families of protection:

Source-based tiers

Standard, Strong, Maximum, and Hyper transform your source with ChaCha20 encryption, control-flow flattening, and ciphertext fragmentation. Hyper is the strongest source tier.

Be aware of the honest limit: any source-based obfuscation can eventually be dumped by a determined attacker who hooks load() and peels the layers back to readable source. That is a fundamental property of running code inside an executor, not a Quark flaw.

Quantum tier

Quantum is different. Instead of encrypting your source, it compiles your script to a custom VM with its own opcode set. Dumping the output yields opcode numbers, not readable Luau, so it is the real defense against the dump attack described above. Quantum is hard-gated: if it cannot guarantee a construct it refuses and falls back to Hyper, and every Quantum output is verified by actually running it in a real Luau VM before delivery.

Nothing running inside an executor is truly unbreakable. Your protection is the combination of server-gated delivery, the HWID lock, and logging — with Quantum raising the dump bar to reverse-engineering a custom VM rather than peeling encryption layers.

Tier	Method	Resists dumping?
Standard / Strong / Maximum	Source encryption + control-flow flattening + fragmentation	Raises effort; ultimately dumpable
Hyper	Strongest source-based build	Raises effort; ultimately dumpable
Quantum	Compiles to a custom VM / opcode set (falls back to Hyper if it can't guarantee a construct)	Dump yields opcodes, not source — the real defense

Step 6 — Publish and get your loader

Choose Publish. The platform obfuscates your source at the tier you selected and returns a raw loader URL of the form:

https://quarkexploits.com/raw/ID.lua

Give buyers the loader snippet below. They set script_key to their own license key and paste it into their executor:

script_key = "THEIR-LICENSE-KEY"
loadstring(game:HttpGet("https://quarkexploits.com/raw/ID.lua"))()

Replace ID with the value from your published URL. When this runs, the loader stub reads the global script_key (and aborts if it is missing), collects the HWID plus player/game/hardware info, and POSTs it to /api/v1/loader/auth. The server validates the key and HWID, binds the HWID on first run and rejects any different HWID afterward (this is the anti‑key‑sharing check), then returns your obfuscated script and fires the Discord webhook server-side. Because the webhook fires on the server, its URL is never in code the buyer can see.

Deep-dive on the request flow, HWID binding, and resets lives on the The Loader & Delivery and Licenses & HWID pages.

Generating licenses

A key system is only useful once it has keys. From the software you can generate a single random key, add a specific manual key, or bulk-generate thousands at once. Each license has a status of active, paused, banned, or expired. A key with no expiry is a lifetime key. The HWID binds on first execution and can be reset from the dashboard or with the bot's /reset command (which has a cooldown). See Licenses & HWID for details.

Updating a system

Because the website is the single source of truth, edits made in the software, on the dashboard, or through the bot all sync to the same record. You can change the source, re-publish at a different tier, and adjust settings later. Re-publishing refreshes the obfuscated build served at your existing raw URL, so your buyers do not need a new loader snippet.

Deleting a system

Deleting a key system removes its raw loader file. The https://quarkexploits.com/raw/ID.lua endpoint stops serving, so every loader that points at it will fail immediately — buyers will no longer receive the script.

Only delete a system when you genuinely want to retire it. If you just want to stop specific users, pause or ban their individual licenses instead of deleting the whole system. Deletion also detaches the associated credentials, so a bot still configured with the old KEY_SYSTEM_ID and API_SECRET can no longer authenticate.

Recap

Open the Key System tab and connect with your Quark key.
Create a system: name, guild ID, buyer role ID, webhook URL, bot token, ticket category.
Copy the api_secret — it is shown only once — into your bot's .env.
Paste your Luau source.
Choose an obfuscation tier (source-based Standard–Hyper, or VM-based Quantum).
Publish to get the raw URL and hand buyers the script_key loadstring snippet.
Generate licenses, then set up the bot on the Discord Bot Setup page.

Need help? Join the community on Discord.