Getting started

Every account gets an API key from the dashboard. Send it with every request in the Authorization header, and Wasp will queue, run, and return your build.

Authentication

Generate a key from your dashboard, then include it as a bearer token on every request:

Authorization: Bearer wasp_live_xxxxxxxxxxxxxxxx

Keys are scoped to your account and plan. Rotate a key any time from the dashboard — the old one stops working immediately.

Obfuscate a script

Send your source as JSON to start a build:

curl https://api.wasp.dev/v1/obfuscate \
  -H "Authorization: Bearer wasp_live_xxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "source": "local function f() return 1 end",
    "preset": "max",
    "vm": "auto"
  }'

field	type	description
source	string	Raw Luau source to obfuscate.
preset	string	`light`, `balanced`, or `max`. Controls how many layers run.
vm	string	`auto` picks a virtualization implementation per build, or pass a specific implementation id.

Response shape

{
  "id": "bld_9f2a1c",
  "status": "complete",
  "output": "-- obfuscated source --",
  "layers": ["virtualize", "flatten", "encrypt_strings", "minify"],
  "watermark": "wm_3c9d2e"
}

Large builds run asynchronously — poll GET /v1/builds/:id until status is complete.

Errors

status	meaning
401	Missing or invalid API key.
402	Build limit reached for your plan.
422	Source failed to parse.
429	Too many requests — see rate limits below.

Rate limits

Community keys are limited to 10 requests per minute; Pro and Enterprise keys scale with your plan. The current limit and remaining count are returned on every response via X-RateLimit-Limit and X-RateLimit-Remaining.