JEESAN Guard DocumentationHomeOverview
JEESAN Guard is a server-side licensing platform for distributing Lua scripts. Create an account, then open the dashboard. The first registered user becomes an administrator. Subsequent users receive the USER role unless an administrator promotes them. Keep private source in the dashboard editor. The loader API is the only supported way for a licensed client to receive an authorized payload.
Scripts
Open JEESAN Guard Scripts and choose Create script. Each script receives a public identifier such as jeesan_8F42K. Upload or paste Lua source in the editor, then save. Every save creates a new version. Previous versions can be restored by administrators. Disable a script to immediately reject loader requests without deleting history.
Keys
Open JEESAN Guard Keys and generate keys in the JEESAN-XXXX-XXXX-XXXX format. Assign a script, optional user, expiration date, maximum activations, and HWID binding. Keys can be enabled, disabled, revoked, extended, or deleted. Revocation is permanent for that key string. Generate a replacement key if you need to restore access.
Keys
A license activates on the first successful loader request that includes a valid key and, when HWID binding is enabled, a device identifier. Activation count increases when a new HWID is bound. Repeat requests from an already-bound device refresh last-used timestamps without consuming extra slots.
API
Request: GET /api/loader/{scriptId}?key=JEESAN-XXXX-XXXX-XXXX&hwid=DEVICE_ID Headers X-License-Key and X-HWID are also accepted. The server validates the script, license status, expiration, blacklist, activation limit, and HWID before returning source. Failed checks never return protected source. Successful JSON: { "success": true, "scriptId": "jeesan_8F42K", "version": 3, "script": "-- lua" } Failed JSON: { "success": false, "error": "Invalid license" }
Security
When HWID binding is enabled, the first authorized device hash is stored. Additional devices are rejected once the activation limit is reached. Administrators can reset HWID bindings. Platform settings control how many resets a key may receive. Raw identifiers are hashed before storage whenever they are provided to the API.
Security
Blacklist entries support USER, LICENSE_KEY, and HWID values. Optional expiration automatically ends enforcement. A matching blacklist entry rejects loader and activation traffic even if the license would otherwise be valid.
API
Dashboard session cookies authenticate browser users. Programmatic access uses JEESAN Guard API credentials. Create a credential in the API page. The secret is shown once. Send it as: Authorization: Bearer jg_... Revoke or rotate credentials from the same page. Secrets are stored as hashes and cannot be recovered later.
API
Sensitive routes are rate limited server-side using PostgreSQL counters: - Login and register - Password reset - Loader API - Key generation and activation - Administrative APIs Exceeded limits return HTTP 429 with { "success": false, "error": "Too many requests" }.
Support
Invalid license: confirm the key belongs to the requested script and is enabled. License expired: extend the key from JEESAN Guard Keys. Activation limit reached: reset HWID or raise max activations. Script has no published source: save at least one editor version. 401 on dashboard APIs: sign in again. 403 means the account lacks the ADMIN role or is disabled. Never share AUTH_SECRET, ENCRYPTION_KEY, or DATABASE_URL. Rotate API credentials if they leak.