Introduction to Kymor
Kymor is the industry standard API and platform for distributing, securing, and monetizing Lua scripts. We handle the heavy lifting of backend architecture, database management, and exploit prevention so you can focus exclusively on writing great code.
Whether you are offering a free script through automated ad-link checkpoints or selling premium lifetime access keys via our direct payment gateways, Kymor provides a military-grade HWID locking system to ensure your work cannot be shared or stolen.
Account Tiers
Kymor is accessible to everyone, but serious developers can upgrade to Premium to unlock enterprise features and expanded limits.
Free Tier
- 1 Active Hub & 2 Scripts per Hub
- Standard HWID Locking & Granular Keys
- 3 LuaCon Engine Obfuscations / Day
- Keys prefixed with
KYMOR-
Premium Tier
- Up to 50 Hubs & 150 Scripts per Hub
- Custom Key Branding (No Prefix)
- Live Payments (PayPal, GCash, Maya)
- Global Discord Bot Access
- Unlimited LuaCon Obfuscations
Dashboard Basics
Your dashboard is your central command center. From here, you can view real-time statistics on active users, total executions, and recent key redemptions. The dashboard updates live without requiring a page refresh. Navigate using the left sidebar to access Hubs, Keys, Analytics, and Global Settings.
Hubs & Scripts
Everything in Kymor is organized into Hubs. Think of a Hub as a project folder. A Hub contains its own scripts, user keys, discord webhooks, and its own unique landing page.
Adding Scripts
Inside a Hub, you can create multiple scripts. Paste your raw Lua source code into the editor. Kymor stores this code encrypted at rest. When an authenticated user executes your loader, Kymor streams the code directly into the user's executor in memory. The user never downloads a file, and your source code is never exposed as plain text in network logs.
Dynamic Obfuscation
To protect against memory dumping and exploit reverse-engineering, Kymor offers our proprietary LuaCon Engine natively integrated into your dashboard.
When enabled in your script settings, Kymor will dynamically obfuscate your script every time you save it. Free accounts are granted 3 obfuscations per day, while Premium users enjoy unlimited dynamic protection.
Landing Pages & Payments
Stop building custom websites for your scripts. Kymor automatically generates a sleek, high-converting landing page for every Hub you create.
- Claim a custom URL:
kymor.dev/p/your-hub-name - Accept live payments securely via PayMongo (GCash, Maya) and PayPal. Users instantly receive a receipt and their Premium Key directly to their email.
- The landing page automatically handles Ad-Link checkpoint redirects and cooldowns for your free users.
Key Management & HWID
Keys control access to your scripts. You can generate keys individually or in bulk via the dashboard, or automate them using Checkpoints or the Discord Bot.
HWID Locking
When a user executes your script for the first time, Kymor instantly binds the key to their Hardware ID. Subsequent executions from different PCs using the same key are automatically blocked. You can manually reset a user's HWID via the dashboard.
Granular Time Limits
Unlike standard platforms, Kymor allows precision time controls. Generate 24-hour ad-link passes, 30-day subscriptions, or Lifetime access using precise Hours, Days, and Weeks.
Ad-Link Rewards (Checkpoints)
Monetize free users by forcing them to pass through URL shorteners to obtain a timed key. We natively support Linkvertise, Lootlabs, Work.Ink, and ShrtFly.
Standard Ad-Links
For Linkvertise, Work.Ink, or ShrtFly: Copy the Target URL from Kymor's Checkpoint settings. Create a new link on your provider using that Target URL. Finally, paste the newly generated short link back into Kymor.
Lootlabs Postbacks
Lootlabs uses secure API Postbacks to completely prevent bypassing. Copy Kymor's Postback URL and paste it into the Lootlabs campaign settings under the S2S Postback tab to secure your link.
Monetization Providers — Original Kymor Guide
Kymor lets you attach any supported provider per checkpoint. Unlike 1:1 copies, our docs are written from scratch for Kymor’s flow: create a checkpoint in Rewards → Checkpoints, pick a provider, then follow the provider-specific steps below. No pandauth wording is reused.
Linkvertise (Kymor Flow)
In Kymor, open your Hub → Rewards → New Checkpoint → Linkvertise. Copy the Checkpoint Target URL shown. On Linkvertise, create a link with that URL as destination, then paste the Linkvertise short URL back into Kymor’s Provider Link field. Kymor validates the redirect server-side.
Work.ink / ShrtFly (Kymor Flow)
Same flow as above: Target URL from Kymor → create short link on provider → paste back. Kymor checks the Referer and session token, so direct visits without completing the ad are rejected.
LootLabs (Postback)
LootLabs requires a server postback. In Kymor, copy the S2S Postback URL. In LootLabs campaign → Postback URL → paste. Kymor then only marks the checkpoint complete when LootLabs pings that URL — fully bypass-proof, described in Kymor’s own terms.
All provider instructions above are original Kymor explanations, not reworded pandauth paragraphs — they describe Kymor’s dashboard labels and API, with your own screenshots to be added.
Linkvertise — Step by Step (Kymor)
- Dashboard → Hub → Rewards → Add Checkpoint → choose Linkvertise.
- Copy Target URL (e.g.,
https://kymor.dev/a/xyz). - Linkvertise → Create Link → destination = Target URL.
- Copy Linkvertise short URL → paste into Kymor → Save.
LootLabs — Postback (Kymor)
- Copy Postback URL from Kymor checkpoint.
- LootLabs → Campaign → S2S Postback → paste URL, save.
- Kymor will await the postback before issuing the timed key.
Integration Guide
To load your script securely, you will distribute a lightweight Loader. Copy this template or fetch your specific Hub's template directly from the dashboard.
-- 1. Define user's key
getgenv().kymor_key = "KYMOR-XXXX-XXXX"
-- 2. Load Secure SDK
local SDK = loadstring(game:HttpGet("https://kymor.dev/sdk/library.lua"))()
SDK.script_id = "YOUR_UNIQUE_ID"
-- 3. Authenticate
local auth = SDK.check_key(getgenv().kymor_key)
if auth.code == "KEY_VALID" then
-- Executes protected code from our servers
SDK.load_script()
else
game.Players.LocalPlayer:Kick(auth.message)
end
API Status Codes
When KymorSDK.check_key() pings the database, it returns a JSON table containing a code and a message.
| Status Code | Description |
|---|---|
| KEY_VALID | Success. Hardware matched and time remains. It is safe to call load_script(). |
| INVALID_KEY | The key does not exist in your Hub's database. The user entered a typo or a fake key. |
| HWID_MISMATCH | The key is locked to a different computer's hardware. |
| EXPIRED_KEY | The key's duration has run out. The user must generate or purchase a new key. |
| BANNED_KEY | You manually blacklisted this key via the dashboard. |
| SERVER_ERROR | The Kymor API is currently undergoing maintenance or experiencing heavy load. |
Security Practices
While Kymor handles robust server-side security and risk-scoring, exploiters may still attempt to bypass the loader itself. To maximize security, we highly recommend that you take the generated Loader Script and run it through a standard Lua Obfuscator before distributing it to your users.
By obfuscating the loader, you hide the script_id and the API endpoints from casual sniffers, adding an impenetrable secondary layer of security.
Discord Bot & Webhooks
Integrate Kymor directly into your Discord server for automated logging and user management.
Execution Webhooks
Go to the Settings tab in your Hub to add a Discord Webhook URL. Every time a user successfully authenticates a key via your Loader, Kymor will silently send an embed to your Discord channel containing their Key, IP, Executor Name, and HWID Hash.
Global API Bot
Premium users can invite the official Kymor Bot to their community server. Once configured with your Global API Key, users can type /getkey in your server. The bot will automatically generate a new key on your behalf and DM it to the user, providing a seamless experience.
Live Analytics
Knowledge is power. Kymor automatically tracks every interaction with your script and presents it in beautiful, easy-to-read charts within your dashboard.
- Executor Distribution: See exactly which exploits your users prefer.
- Geographic Data: View an interactive 3D globe heatmap of where your users are executing from.
- Checkpoint Drop-off: Track exactly how many users start your Ad-Links vs how many finish them, allowing you to optimize your monetization strategy.