Syntexxx API — Lua Obfuscation

Base URL

https://api-syntexxx.pages.dev

All requests use JSON bodies and return JSON responses.

Overview

Protection Layers

VM Depth

<1s

Avg Response

Obfuscate Code

POST /api/v1/obfuscate

Authentication

Include your API key in the Authorization header:

Authorization: Bearer stx_YOUR_API_KEY

Minimal Request

{
  "code": "print('Hello World')"
}

Full Request

{
  "code": "local secretKey = 0xDEADBEEF\nlocal function verify(input)\n  return input == secretKey\nend\nprint(verify(123))",
  "options": {
    "useLuaVM": true,
    "loaderVMDepth": 3,
    "encryptStrings": true,
    "proxifyLocals": true,
    "proxifyFunctions": true,
    "antiTamper": true,
    "isLuauRuntime": true,
    "controlFlowFlattening": true,
    "minify": true
  }
}

Preset Request

{
  "code": "print('Protect me with luavm preset')",
  "preset": "luavm"
}

Configuration Options

Option	Type	Default	Description
useLuaVM	boolean	true	Virtualizes AST into custom LuaVM bytecode with dynamic opcode shuffling
loaderVMDepth	integer	3	Nested VM layers (1-5). Higher = stronger protection
encryptStrings	boolean	true	Encrypts all string literals, decoded at runtime
proxifyLocals	boolean	true	Wraps locals into metatable proxy containers
proxifyFunctions	boolean	true	Wraps functions through callable proxies
antiTamper	boolean	true	Injects environment verification & anti-hooking checks
isLuauRuntime	boolean	true	Protects against Luau deobfuscators
controlFlowFlattening	boolean	true	Flattens execution into state-machine driven blocks
minify	boolean	true	Strips debug symbols, comments, mangles identifiers

Responses

200 — Success

{
  "success": true,
  "code": "--[( syntexxx.pages.dev )]--\nlocal ...",
  "stats": {
    "input_bytes": 35,
    "output_bytes": 16420,
    "elapsed_seconds": 0.38
  }
}

200 — Syntax Error

{
  "success": false,
  "error": "Syntax Error on line 2: no viable alternative at input '='",
  "error_details": {
    "line": 2,
    "column": 9,
    "detail": "no viable alternative at input '='",
    "suggestion": "Lua uses '==' for equality and '~=' for inequality.",
    "snippet": "        1 | local x = 1\n>>> 2 | if x === 2 then\n    |         ^\n    3 |     print('bad')\n    4 | end"
  }
}

400 — Bad Request

{
  "success": false,
  "error": "Missing or invalid \"code\" field. Must be a non-empty string."
}

Code Examples

JavaScript (fetch)

const response = await fetch('https://api-syntexxx.pages.dev/api/v1/obfuscate', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer stx_YOUR_API_KEY'
  },
  body: JSON.stringify({
    code: "print('Hello from Syntexxx!')",
    options: { useLuaVM: true, loaderVMDepth: 3 }
  })
});

const data = await response.json();
if (data.success) {
  console.log('Protected code:', data.code);
} else {
  console.error('Error:', data.error);
}

Python (requests)

import requests

response = requests.post(
    "https://api-syntexxx.pages.dev/api/v1/obfuscate",
    headers={"Authorization": "Bearer stx_YOUR_API_KEY"},
    json={
        "code": "local a, b = 10, 20\nprint(a + b)",
        "options": {
            "useLuaVM": True,
            "loaderVMDepth": 3,
            "encryptStrings": True,
        }
    }
)

data = response.json()
if data.get("success"):
    print(f"Output size: {len(data['code'])} bytes")
else:
    print(f"Error: {data.get('error')}")

cURL

curl -X POST https://api-syntexxx.pages.dev/api/v1/obfuscate \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer stx_YOUR_API_KEY" \
  -d '{"code": "print(1+1)", "options": {"useLuaVM": true}}'

Roblox / Luau (HttpService)

local HttpService = game:GetService("HttpService")

local response = HttpService:RequestAsync({
    Url = "https://api-syntexxx.pages.dev/api/v1/obfuscate",
    Method = "POST",
    Headers = {
        ["Content-Type"] = "application/json",
        ["Authorization"] = "Bearer stx_YOUR_API_KEY"
    },
    Body = HttpService:JSONEncode({
        code = "local key = 'VIP'\nprint(key)",
        options = { useLuaVM = true, loaderVMDepth = 3 }
    })
})

if response.Success then
    local data = HttpService:JSONDecode(response.Body)
    if data.success then
        print("Protected! Size:", #data.code)
    end
end

Rate Limits & Notes

Requests are subject to the upstream rate limits of the obfuscation service. For high-volume usage, include a valid API key.

The Authorization header is forwarded to the upstream service. Generate a key from the Syntexxx dashboard.