API

Upload, protect, and download from CI with the same backend used by the panel.

Authentication

Create an API key under Panel → API keys. Send it as a bearer token on every protected route. Keys start with cp_, and the complete value is shown once.

Treat the key like a password. Store it in your CI secret manager, never in source control or a browser bundle.

Walkthrough

1. Upload a file

Send the source as multipart form data. The response includes the file id.

curl -X POST https://api.codeprotect.example/api/v1/files/upload \
  -H "Authorization: Bearer cp_your_key" \
  -F "file=@script.lua"

2. Start obfuscation

Reference the file id. Omit "obfuscator" to infer the engine from the extension.

curl -X POST https://api.codeprotect.example/api/v1/obfuscate \
  -H "Authorization: Bearer cp_your_key" \
  -H "Content-Type: application/json" \
  -d '{"file_id":"<id>","obfuscator":"lua-v2"}'

3. Poll status

The file moves pending → processing → completed. Poll until it settles.

curl https://api.codeprotect.example/api/v1/files/<id> \
  -H "Authorization: Bearer cp_your_key"

4. Download the output

Once completed, pull the protected artifact.

curl https://api.codeprotect.example/api/v1/files/<id>/download?type=obfuscated \
  -H "Authorization: Bearer cp_your_key" \
  -o script.protected.lua

Retries and limits

Obfuscation is limited to 20 requests per minute per user. Lua v2 accepts an Idempotency-Key header of up to 128 characters, so a timed-out request can be retried without starting a duplicate build.

Errors use the shape {"error":"message"}. A 429 response reports the rate-limit failure in that body. Upload errors can also include per-file details for multi-file requests.