> For the complete documentation index, see [llms.txt](https://vampauth.gitbook.io/vampauth-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vampauth.gitbook.io/vampauth-docs/api-reference/key-check.md).

# Standalone key check

Use `POST https://vampauth.com/api/v1/key/check` from your backend when your app doesn't use a Roblox loader. It checks access and signs the result. It doesn't deliver a script or create/renew loader sessions.

## Request

Send application/json, with an 8 KiB body limit:

```json
{
  "project_id": "YOUR_PROJECT_ID",
  "key": "USER_KEY",
  "hwid": "64-character lowercase SHA-256 hex",
  "nonce": "fresh-random-value-at-least-16-characters",
  "signature": "40-character lowercase HMAC-SHA1 hex"
}
```

* `project_id`: public 16-character alphanumeric ID or project UUID.
* `key`: 1–128 characters, no leading/trailing whitespace or control characters.
* `hwid`: SHA-256 of a stable device identifier, as 64 lowercase hex characters. Your application supplies the identity.
* `nonce`: fresh random 16–128 characters, letters/digits/underscore/hyphen only.
* `signature`: HMAC-SHA1 of `nonce|key|hwid` with the current project auth secret as UTF-8 text. Don't hex-decode the secret.

Use the project secret supplied to your backend; it is not the old Client Secret or a v2 token. Don't place it in a player's script or browser bundle.

## Success

HTTP 200:

```json
{
  "status": "valid",
  "project_id": "YOUR_PROJECT_ID",
  "hwid_bound": true,
  "expires_at": null,
  "nonce_echo": "the-nonce-you-sent",
  "signature": "40-character lowercase HMAC-SHA1 hex"
}
```

`expires_at` is an ISO timestamp or null for lifetime access. A pending first-use key activates on successful validation, so this call isn't a read-only inventory probe. Usage/last-used statistics are updated too.

Before accepting access, check status, exact echoed project ID, nonce echo, and the signature. The response signing message is `nonce|status|expiryUnixSeconds|project_id`. Convert expiry to whole Unix seconds; use 0 for null. Sign with the same HMAC-SHA1 helper and compare in constant time.

The signature covers those four values, not the whole JSON body. Error responses have no success signature. Hardware binding applies on first successful use unless FFA/binding-off; hardware bans still apply.

## Errors and limits

Errors are `{"error":"code"}`. Rate limit: 120 requests/minute/IP; 429 includes `Retry-After: 60`. Responses use no-store.

| HTTP | Code                 | Fix                                                  |
| ---- | -------------------- | ---------------------------------------------------- |
| 400  | invalid\_request     | Check field format/body size                         |
| 401  | invalid\_signature   | Check current secret, field order and UTF-8 encoding |
| 404  | invalid\_project     | Use the correct public ID or UUID                    |
| 404  | invalid\_key         | Check key and project                                |
| 403  | key\_revoked         | Ask the owner to review the key                      |
| 410  | key\_expired         | Renew or replace the key                             |
| 403  | hwid\_mismatch       | Use the bound device or reset legitimately           |
| 403  | blacklisted          | Owner must review the project hardware ban           |
| 429  | rate\_limited        | Wait for Retry-After                                 |
| 503  | service\_unavailable | Retry later with backoff                             |

Keyless loader mode doesn't remove this endpoint's real-key requirement.

## Next steps

* [Node.js key-check client](/vampauth-docs/development/key-check.md)
* [Environment variables](/vampauth-docs/development/environment-variables.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://vampauth.gitbook.io/vampauth-docs/api-reference/key-check.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.