> For the complete documentation index, see [llms.txt](https://docs.zaroguard.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zaroguard.com/user-manual.md).

# User Manual

Quickstart login steps and account access guidance.

## ZaroGuard User Manual

**Last updated: August 3, 2026**

This manual explains how a developer activates a ZaroGuard account, protects and manages scripts, configures access controls and webhooks, operates the key system, and diagnoses execution problems.

For quick answers, see the FAQ. Use of ZaroGuard is also subject to the Terms of Service and Privacy Policy.

### 1. Before You Begin

You need:

* a supported web browser;
* a Discord account;
* a valid ZaroGuard access key or assigned subscription;
* the original Lua source you are authorized to protect; and
* permission to distribute and operate that script.

Keep your original source in your own private backup. ZaroGuard stores the protected output used for delivery and is not a replacement for source control.

Never share your ZaroGuard access key, session cookie, Discord webhook URL, Cloudflare tunnel token, private key, or other bearer credential.

### 2. Sign In and Activate Your Account

#### Step 1: Open the login flow

Open the ZaroGuard website and select **Get Started** or **Login**.

#### Step 2: Complete the CAPTCHA

Complete the displayed hCaptcha or Cloudflare Turnstile challenge, then select **Continue with Discord**.

If CAPTCHA repeatedly fails:

* disable aggressive content blockers for the login page;
* confirm JavaScript and cookies are enabled;
* avoid rapidly refreshing the challenge;
* disable a broken VPN or proxy; and
* verify that your clock and network connection are correct.

#### Step 3: Authorize Discord

Review the Discord permissions and select **Authorize**.

ZaroGuard associates the authorized Discord identity with the applicable account and access key. Do not authorize an account belonging to someone else.

#### Step 4: Enter your access key

On the final verification page, enter your ZaroGuard access key and select **Verify & Unlock**.

After successful verification, you are redirected to the dashboard.

#### When does the subscription timer begin?

If an administrator assigned a subscription that displays `NOT STARTED YET`, its timer begins when the account successfully completes the activation or authenticated login flow that starts the subscription. The expiration date is then calculated from the plan duration.

### 3. Dashboard Overview

The dashboard may provide the following areas, depending on your subscription and configuration:

* **Dashboard** — account status, usage, limits, and summary information;
* **Scripts** — upload, view, copy, edit, replace, enable, disable, and delete protected scripts;
* **Keys** — create and manage user keys;
* **Checkpoints** — configure earn-flow checkpoints;
* **Webhook** — configure Discord success and denied-event delivery;
* **Settings** — configure key-system and earn-page behavior, Themes etc;
* **HWID Ban** — configure a remote HWID deny list;

Your plan controls the number of scripts and obfuscation operations available. The dashboard is the best place to view current usage.

### 4. Protect and Upload a Script

#### Step 1: Open Scripts

Open **Scripts**, then select the option to add or upload a script.

#### Step 2: Enter script information

Provide:

* **Script name** — required, 1–64 characters; letters, numbers, spaces, `_`, `.`, and `-` are accepted;
* **Main file** — required Lua source; and
* **Loading UI code** — optional Stage 2 interface code when the feature is enabled. Supports upto 50kb

The loading UI is enabled by default. If no custom UI code is supplied, ZaroGuard uses its default loading UI. Custom UI code is validated before it is accepted.

#### Step 3: Confirm available limits

An upload requires:

* an active subscription;
* an unused script slot; and
* at least one remaining obfuscation credit.

If a limit has been reached, the server rejects the upload without creating a usable script.

#### Step 4: Upload and wait for protection

ZaroGuard combines the required execution-environment setup with your source, protects the resulting payload, verifies the output, splits it into five ordered chunks, and stores those protected chunks for delivery.

Do not close the page or repeatedly submit the form while protection is running. Large scripts and remote obfuscators may take longer.

An obfuscation credit is deducted only as part of a successful protection workflow.

#### Step 5: Copy the generated loader

After a successful upload, ZaroGuard displays a generated loader similar to:

```lua
loadstring(game:HttpGet('https://zaroguard.com/random-path/filev1?loader=SCRIPT_ID'))()
```

Use the exact loader generated by the dashboard. Do not manually replace tokens, remove the randomized path, or expose internal stage URLs.

### 5. Manage Existing Scripts

#### View and copy a loader

Open **Scripts**, find the script, and copy its displayed loader. Copy the complete value and avoid chat applications that rewrite punctuation or add preview text.

#### Enable or disable a script

Use the script status control to switch it between active and disabled.

Disabling a script:

* prevents normal protected execution;
* invalidates or cleans applicable temporary delivery links; and
* keeps the script record available for later management.

Re-enable it when you are ready to permit execution again.

#### Edit script metadata

You can update supported fields such as name, loading UI, and enabled status. Input validation still applies.

Changes affecting protected loader inputs or cache versions may require regenerated stage caches before users receive the new version.

#### Replace or reupload code

Use the reupload or replace action when the underlying Lua code changes. ZaroGuard protects the new payload and replaces the stored protected chunks after a successful operation.

Keep your old source and verify the new protected version before distributing it widely.

#### Delete a script

Deleting a script removes its script record and applicable protected-stage cache entry. The service also expires associated temporary delivery links through its cleanup systems.

Deletion is intended to be permanent. Confirm the script ID and retain your own source backup before deleting.

### 6. Configure Discord Webhooks

Open **Webhook** to configure optional Discord notification delivery.

#### Success webhook

The success webhook can receive successful execution or completion events and certain account notifications.

#### Denied webhook

The denied webhook can receive denied access, sanitized security events, incomplete progression, or other configured failure notifications.

#### Add a webhook

1. In Discord, open the target channel settings.
2. Create an integration webhook.
3. Copy the complete Discord webhook URL.
4. Paste it into the corresponding ZaroGuard field.
5. Save the configuration.
6. Use the webhook test feature when available.

Only valid Discord or Discordapp webhook URLs are accepted. After saving, the dashboard masks the secret token portion when returning the URL to the browser.

Treat a webhook URL like a password. Anyone with the complete URL can post to that webhook. Delete and recreate it in Discord if it is exposed.

#### Avoid duplicate notifications

ZaroGuard deduplicates repeated client errors and limits owner security alerts for the same execution session. The master security webhook may receive more detailed operational diagnostics than an owner's webhook.

### 7. Configure an HWID Ban List

The **HWID Ban** page accepts a raw GitHub text-file URL.

#### Create the file

1. Open a GitHub repository you control.
2. Create a file such as `blacklist.txt`.
3. Put one blocked HWID on each line.
4. Commit the file.
5. Open the file and select **Raw**.
6. Copy the raw URL.

Example file:

```
a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
f6e5d4c3b2a1f6e5d4c3b2a1f6e5d4c3
1234567890abcdef1234567890abcdef
```

Use only HWIDs, one per line. Do not include labels, commas, JSON, Lua code, or comments unless the current parser explicitly supports them.

#### Save the URL

Paste the URL into **HWID Ban** and save it. The URL must begin with:

```
https://raw.githubusercontent.com/
```

Wrong:

```
https://github.com/yourname/repo/blob/main/blacklist.txt
```

Correct:

```
https://raw.githubusercontent.com/yourname/repo/main/blacklist.txt
```

Clear the saved field if you no longer want to use the remote list.

### 8. Key System

The key system is separate from the developer's own dashboard access key. It lets a developer issue keys to users of their hub or script.

#### Key settings

Open **Settings** to configure available options such as:

* hub name;
* default key duration;
* maximum active keys;
* creation cooldown;
* maximum allowed hours;
* whether users may extend or forget keys;
* incognito or VPN restrictions;
* CAPTCHA behavior;
* checkpoint count;
* Linkvertise account information when used; and
* custom earn URL slug for eligible tiers.

Custom earn slugs are available to Pro, Elite, and Enterprise tiers. A slug must be unique, use valid letters, numbers, or hyphens, and must not be a reserved application route.

Do not publish the owner's private API key or Linkvertise token.

#### Create a user key

Open **Keys**, then create a key with the desired:

* lifetime in hours;
* maximum checkpoint requirement; and
* checkpoint-bypass setting, if authorized.

The server may reject creation when the account's configured key quota is reached.

#### Manage a user key

Available actions include:

* viewing active and expired keys;
* adding time;
* toggling ban status; and
* deleting a key.

Confirm the exact key before changing or deleting it.

#### Verify a key from a script

The public verification API validates an owner API key together with the user's key, HWID, Roblox username, and Roblox user ID. Use the documented integration format in Key System API.

Never place an administrative dashboard access key where ordinary script users can retrieve it.

### 9. Earn Flow and Checkpoints

The earn system can require users to complete configured checkpoints before receiving or extending a key.

#### Configure checkpoints

Open **Checkpoints** to:

* create a checkpoint;
* select its link mode;
* associate applicable Linkvertise information;
* update the shortened destination; or
* delete the checkpoint.

The account is limited to the server's configured maximum number of owner checkpoints.

#### Earn URL

The default earn URL uses the owner's API key. Eligible tiers can configure a custom slug under the ZaroGuard key domain.

Test the complete earn flow after changing checkpoint order, account credentials, CAPTCHA settings, or custom URL configuration.

#### Protect checkpoint credentials

Linkvertise tokens and similar provider credentials are secrets. Enter them only through the authenticated dashboard and rotate them if exposed.

### 10. Logs and Analytics

#### Recent logs

The **Logs** area displays recent access events for your scripts, including success or denial status and relevant execution information. Ordinary database access logs are scheduled for deletion after approximately 12 hours.

#### Dashboard statistics

Statistics may include:

* total successful and denied executions;
* success rate;
* unique HWIDs, users, and IPs;
* activity during the latest and previous 24-hour periods;
* top scripts;
* top approximate countries; and
* common denial reasons.

Statistics can be cached briefly for performance and should not be treated as billing-grade measurements.

#### Key analytics

Key analytics can show key creation, verification, checkpoint, claim, and related earn-flow activity depending on the configured system.

Use analytics for support and abuse investigation. Do not use HWIDs, countries, or user identities to harass, expose, or unlawfully track users.

### 11. Understanding Security Alerts

#### Client Kick Detected

The client reported that the protected loader stopped and kicked the user. Read the **Message** field for the actual reason. A kick is not automatically proof of malicious behavior; network, DNS, executor, or memory failures can also cause it.

### 12. Troubleshooting

#### Login loops back to the verification page

Check:

* cookies are enabled;
* the public page uses HTTPS;
* Cloudflare forwards the original protocol correctly;
* the session-cookie secure setting matches HTTPS;
* the session store is available; and
* Discord OAuth returns to the configured callback URL.

#### Script upload fails

Check the server response and confirm:

* the subscription is active;
* a script slot remains;
* an obfuscation credit remains;
* the script name, description, and version are valid;
* a non-empty Lua file was selected;
* custom UI code passed validation; and
* the configured obfuscator is reachable.