JEESAN Guard is a licensing and secure-distribution platform for Lua scripts. Your source code stays encrypted on the server. Buyers receive it ONLY after a valid license key (and device check) passes. Everything else — keys, expiry, devices, leaks — is automated. WHO IS THIS FOR - Script sellers who want protected delivery and paid licenses. - Teams who need resellers to generate keys safely via API. THE 5-MINUTE SETUP 1. Register an account. The first account on a fresh platform becomes ADMIN. 2. Subscribe from Billing (300 BDT/month) to unlock script uploads and keys. 3. Create your first script and paste your Lua source. 4. Generate license keys with the validity duration you want. 5. Give buyers this one line:

loadstring(game:HttpGet('https://jeesan.titanfallsmp.xyz/api/bootstrap/YOUR_SCRIPT_ID'))()

Buyers run it in their executor, paste the key, done. Everything after that — activation, HWID binding, expiry, anti-leak watermarking — happens automatically.

SCRIPTS PLAN — 300 BDT/month Upload scripts, create unlimited keys manually from the dashboard, use all loader endpoints, Leak Shield, HWID tools, blacklist and analytics. API PLAN — 200 BDT/month (requires the Scripts plan) Everything above PLUS programmatic access: - POST /api/v1/keygen → auto-generate keys from your own website/bot - POST /api/v1/keys/validate → check any key without consuming activations Both plans are monthly and managed from Dashboard → Billing. Redeem codes can extend either plan.

CREATE Dashboard → Scripts → Create script. Each script gets a public ID like jeesan_8F42K used in loader URLs and API calls. SOURCE & VERSIONS Paste or edit Lua in the built-in editor. Every save creates a numbered version with an optional note. You can view or restore any previous version at any time — safe experimentation without risk. SEARCH & REPLACE The editor toolbar has find/replace across the whole source before saving. ENABLE / DISABLE The Enable/Disable button instantly rejects ALL loader requests for that script without deleting anything. Use it during maintenance or investigations. BUILT-IN LOADER ON/OFF Each script has its own "Built-in loader" switch. Turn it OFF when you want the script to load directly (no key input GUI) or when you ship your own custom loader UI (see the Custom Loader API article). The loadstring URL serves the script source immediately for execution. LEAK SHIELD Every script includes automatic anti-key-sharing protection. See the Security section below.

GENERATE MANUALLY Dashboard → Keys → Generate. Choose a script, how many keys you need, then pick a VALIDITY DURATION: - 1 day → trials - 3 days → short tests - 7 days → weekly plans - 14 days → bi-weekly plans - 30 days → monthly (most common) - 60 days → 2 months - 90 days → quarterly - 180 days → 6 months - 365 days → yearly - Custom… → any number of days - Lifetime → never expires The expiry preview shows the exact date buyers will see BEFORE you generate. Also set Max activations (device slots) and HWID binding per key batch. KEY LIFECYCLE - Enable / Disable → temporary pause, reversible - Revoke → permanent kill for that key string - Extend → add days to an existing key - Reset HWID → free a device slot when a buyer changes PC - Delete → remove permanently A revoked key stays dead forever. Generate a fresh key if access must be restored.

HOW A KEY ACTIVATES A license activates on the first successful loader request containing that key. If HWID binding is ON for the key, the buyer's device fingerprint is bound at that moment. DEVICE SLOTS Max activations = how many different devices may bind to the key. Repeat runs from an already-bound device are free — they refresh "last seen" but never consume extra slots. A NEW device binds only while slots remain; otherwise the loader returns "Activation limit reached". BUYER CHANGED DEVICE? Dashboard → Keys → Reset HWID on that key. The next run rebinds cleanly. PRIVACY BY DESIGN Raw device IDs and IP addresses are hashed (SHA-256) before storage. The platform never stores them in readable form.

TWO READY-MADE WAYS TO DELIVER 1) GUI LOADER — recommended for buyers. Shows a clean key-input window in game:

loadstring(game:HttpGet('https://jeesan.titanfallsmp.xyz/api/bootstrap/{scriptId}'))()

2) RAW SOURCE URL — for advanced setups / your own UI:

GET https://jeesan.titanfallsmp.xyz/api/loader/{scriptId}/raw?key=XXXX-XXXX-XXXX-XXXX&hwid=DEVICE_ID

Headers X-License-Key and X-HWID are also accepted. Browser requests are redirected away — these endpoints are executor-only. SUCCESS RESPONSE (JSON variant)

{ "success": true, "scriptId": "jeesan_8F42K", "version": 3, "script": "-- lua" }

FAILURE (never leaks source)

{ "success": false, "error": "Invalid license" }

Every success is minified, watermarked per buyer, logged, and marked no-store/noindex/noarchive.

Want YOUR OWN loader design instead of the built-in GUI? Fully supported. SETUP 1. Open your script in the dashboard. 2. Switch "Built-in loader" OFF — the platform GUI/loadstring stops serving that script. 3. Ship your loader calling the endpoint below. ENDPOINT

POST https://jeesan.titanfallsmp.xyz/api/v1/loader/auth
Content-Type: application/json

{ "scriptId": "jeesan_8F42K", "key": "XXXX-XXXX-XXXX-XXXX", "hwid": "device-id" }

NO SECRET API KEY GOES INSIDE YOUR LOADER. The buyer's license key is the only secret — identical trust model to the built-in loader, so nothing sensitive ships publicly. RESPONSES

200 { "success": true, "scriptId": "...", "scriptName": "...", "version": 3,
      "script": "protected minified+watermarked lua" }
401 invalid key · 403 expired/revoked/blacklisted/device limit
404 unknown script · 423 built-in loader disabled · 429 rate limited

EXECUTOR TEMPLATE

lua
local HttpService = game:GetService("HttpService")
local res = request({
	Url = "https://jeesan.titanfallsmp.xyz/api/v1/loader/auth",
	Method = "POST",
	Headers = { ["Content-Type"] = "application/json" },
	Body = HttpService:JSONEncode({
		scriptId = "YOUR_SCRIPT_ID",
		key = enteredKey,
		hwid = tostring(game.Players.LocalPlayer.UserId),
	}),
})
local data = HttpService:JSONDecode(res.Body)
if data.success then
	loadstring(data.script)()
else
	warn("[Loader] " .. tostring(data.error))
end

The full key system still applies: expiry, blacklist, HWID binding, activation limits, Leak Shield, watermarking.

Generate license keys automatically from your website, Discord bot, payment flow or reseller panel. Requires the API plan (200 BDT/month). REQUEST

POST https://jeesan.titanfallsmp.xyz/api/v1/keygen
Authorization: Bearer jg_YOUR_API_KEY
Content-Type: application/json

{
  "script":         "jeesan_8F42K",   -- required (id or publicId)
  "count":          5,                -- optional, 1-100, default 1
  "expiresDays":    30,               -- optional; omit = lifetime
  "maxActivations": 1,                -- optional, default 1 (max 100)
  "hwidBound":      true,             -- optional, default true
  "note":           "order #42"       -- optional label echoed back
}

VALIDITY PRESETS 1 = day trial · 7 = weekly · 30 = monthly · 90 = quarterly · 365 = yearly · omit = lifetime. Any other value 1–3650 works too. PROFESSIONAL RESPONSE (201)

{
  "success": true,
  "script":  { "id": "...", "publicId": "jeesan_8F42K", "name": "My Script" },
  "generated": 2,
  "validity": { "days": 30, "expiresAt": "2026-09-23T...", "lifetime": false },
  "options":  { "maxActivations": 1, "hwidBound": true },
  "keys":     ["ABCD-EFGH-JKLM-NPQR", "STUV-WXYZ-1234-5678"],
  "licenses": [
    { "key": "ABCD-EFGH-JKLM-NPQR",
      "expiresAt": "2026-09-23T...", "lifetime": false,
      "maxActivations": 1, "hwidBound": true,
      "loaderUrl":  "https://jeesan.titanfallsmp.xyz/api/bootstrap/jeesan_8F42K",
      "directUrl":  "https://jeesan.titanfallsmp.xyz/api/loader/jeesan_8F42K/raw?key=..." }
  ],
  "usage": "loadstring(game:HttpGet('https://jeesan.titanfallsmp.xyz/api/bootstrap/jeesan_8F42K'))()"
}

keys = plain string array (backward compatible). licenses = rich objects ready to show customers or store in your own database. ERRORS 401 missing/invalid jg_ key · 402 no API plan · 404 script not yours · 429 rate limit (60/min). Send GET to the same URL to receive this documentation as JSON.

Read-only status check for any license key. NEVER binds HWIDs and NEVER consumes activations. Perfect for pre-checks in bots or panels. REQUEST

POST https://jeesan.titanfallsmp.xyz/api/v1/keys/validate
Authorization: Bearer jg_YOUR_API_KEY
Content-Type: application/json

{ "key": "XXXX-XXXX-XXXX-XXXX", "hwid": "optional-device-id" }

RESPONSE (always 200 — check the valid field)

{ "valid": true,  "script": "jeesan_8F42K", "scriptName": "My Script",
  "hwidBound": true, "activationsLeft": null, "expiresAt": "2026-09-23T..." }

{ "valid": false, "reason": "License expired" }

activationsLeft is null when unlimited or already-bound. Possible reasons: Invalid license, License revoked, License disabled, License expired, Activation limit reached, License is blacklisted.

DASHBOARD ACCESS Browser sessions use secure cookies via NextAuth. Two-factor authentication is available per account. PROGRAMMATIC ACCESS 1. Dashboard → API → choose a name → Create. 2. Copy the jg_... secret shown ONCE (stored only as a hash — unrecoverable). 3. Send it on every call:

Authorization: Bearer jg_YOUR_SECRET

SECURITY PRACTICES - Rotate from the same page if a secret may have leaked (old secret dies instantly). - Revoke unused credentials. - Never commit secrets to git, and never embed a jg_ key inside a distributed loader — public loaders must only ever contain the buyer's license key flow.

Server-side PostgreSQL counters protect every sensitive route: - Loader endpoints → platform setting (default 60/min per IP+script) - Key validation → 120/min per credential - Key generation → 60/min per user - Login/register/reset → strict low limits - Admin APIs → separate limits Exceeding a limit returns:

HTTP 429
{ "success": false, "error": "Too many requests" }
Retry-After: <seconds>

Back off until Retry-After passes. Limits reset automatically — no support ticket needed.

HTTP 400 Bad request / malformed payload HTTP 401 Missing or invalid credentials (jg_ key or session) HTTP 402 Payment required — plan missing (e.g. API_PLAN_REQUIRED) HTTP 403 Forbidden — expired / revoked / blacklisted / device limit / wrong role HTTP 404 Script, key or resource not found HTTP 409 Conflict — e.g. script has no published version yet HTTP 423 Locked — built-in loader disabled for this script (use custom loader API) HTTP 429 Rate limited — respect Retry-After HTTP 500 Server fault — retry once, then contact support Loader failures always return { "success": false, "error": "human readable message" } and NEVER include source code.

Five independent layers protect your source and your income: 1. ENCRYPTED AT REST — source is AES-encrypted in the database; the plaintext never touches disk or logs. 2. LICENSE GATE — delivery requires script match + enabled key + valid expiry + blacklist pass + HWID/activation rules. Failed checks return zero bytes of source. 3. INVISIBLE WATERMARK — every delivery embeds an AES-256-GCM token (license, user, device hash, exact time) using zero-width characters plus redundant hidden copies. Survives copy/paste and most cleanup. 4. MINIFY — comments and indentation stripped server-side, so nothing readable ships. 5. TRANSPORT HARDENING — no-store/noarchive/noindex headers, browser-navigation redirects, executor-only enforcement. IF SOMETHING LEAKS ANYWAY Admin panel → Leak Trace: paste the leaked text (any fragment works). You instantly get the exact license key, owner email, device hashes and delivery time. Then revoke the key, blacklist the HWID, done — the leaker loses access and everyone can see exactly who did it. Honest engineering note: NO platform can physically stop someone from saving text their executor already received. JEESAN Guard's model makes every leak attributable within seconds and cuts off shared keys automatically — which is what actually protects revenue.

The #1 way sellers lose money: one buyer shares their key with ten friends. Leak Shield kills this automatically. HOW IT WORKS Per script, the shield tracks distinct device/IP fingerprints per key over a rolling 24-hour window (default limit: 3). When a key exceeds the limit: - New devices get blocked instantly (HTTP 403 "Key sharing detected") - You receive a red DISCORD ALERT: masked key, script, device count - A dashboard notification is created - Every attempt is logged with hashed IP + HWID Legitimate single-device buyers never notice it exists. CONFIGURE Dashboard → open script → Leak Shield panel → ON/OFF + max devices per day (1–50). Default ON at 3. WHAT TO DO WHEN TRIGGERED Open API logs around that time → identify the extra devices → Reset HWID if legitimate, or Revoke + Blacklist if not.

BINDING When a key has HWID binding ON, the first authorized device hash is stored permanently against the key. Additional devices bind only while activation slots remain. RESETS Dashboard → Keys → Reset HWID frees the bindings so the buyer can move devices. Platform settings control how many resets each key allows. BLACKLISTING Any observed HWID hash can be blacklisted globally (Admin → Blacklist) — the device is rejected everywhere, even on brand-new keys, until the entry expires or is removed. PRIVACY Raw HWIDs and IPs are hashed before storage and are never reversible from the dashboard.

Three blacklist types, enforced on EVERY loader request before anything else: USER → blocks the whole account's keys LICENSE_KEY → blocks one key string HWID → blocks one device everywhere Optional expiry ends enforcement automatically. Matching entries reject traffic even if the license itself looks perfectly valid — blacklist always wins. Use cases: leaked keys, refund abusers, known dumpers' devices, ban evaders.

"Invalid license" → Key doesn't belong to that script, was mistyped, or doesn't exist. Check Dashboard → Keys. "License expired" → Extend the key (Keys → Extend) or issue a new one with a longer duration. "Activation limit reached" → Buyer changed device? Keys → Reset HWID. Extra permanent devices? Generate a key with higher maxActivations. "Key sharing detected" → Leak Shield fired. Review API logs; Reset HWID for legit moves or Revoke + Blacklist abusers. "Built-in loader is disabled" → The script owner turned off the built-in loader. The loadstring URL now serves the script directly without a key GUI. If you need key protection, contact the script owner to enable the built-in loader or use the custom loader API. "Script has no published source" → Save at least one version in the editor first. 401 on dashboard APIs → sign in again or rotate the jg_ credential. 403 on admin routes → account needs the ADMIN role. SECURITY RULES FOR ADMINS Never share AUTH_SECRET, ENCRYPTION_KEY or DATABASE_URL. Rotate any credential that may have leaked. All three are checked into .env only — never into git.