ArrStudio API

How ArrStudio kits running in a Roblox place talk to this website. A kit reads its license key from its own Config module and calls one endpoint on server start. Everything else — accounts, licenses, kits — is managed on the website.

Base URL

https://arrstudioweb.vercel.app

Format

JSON over HTTPS

Auth (kits)

License key in body

Connect from Roblox

1. 1. Enable HTTP requests

   In Roblox Studio: Game Settings → Security → Allow HTTP Requests. The kit can't reach the API without it.

2. 2. Add the license module to the kit

   Copy roblox/ArrLicense.lua from this repository into the kit as a ModuleScript (e.g. ClubKit/Core/ArrLicense) and set its URL:

   ArrLicense.luaCopy

   ArrLicense.API_URL = "https://arrstudioweb.vercel.app"

3. 3. The buyer pastes their key into Config

   ClubKit/ConfigCopy

   -- ClubKit/Config (ModuleScript) — the only file buyers edit
   return {
   	LicenseKey = "ARR-XXXX-XXXX-XXXX",
   
   	-- point the kit at what your place already uses
   	DataStore = "PlayerData_v3",
   	GroupId = 3401192,
   	Gamepasses = { VIP = 71829301, DJ = 71829455 },
   	Leaderstats = { Currency = "Coins" },
   }

4. 4. Verify before starting the kit

   Run this from a server Script. Never require the module from a LocalScript — the key must not reach clients.

   ClubKit/Bootstrap (server)Copy

   -- ClubKit/Bootstrap (Script, server)
   local Kit = script.Parent
   local Config = require(Kit.Config)
   local ArrLicense = require(Kit.Core.ArrLicense)
   
   local ok, result = ArrLicense.verify({
   	key = Config.LicenseKey,
   	kit = "clubkit",       -- kit id from /admin → Kits
   	version = "1.2.0",     -- the version of this kit build
   	onRevoked = function(code, message)
   		warn("[ClubKit] license stopped:", code, message)
   		Kit.Core:SetAttribute("Licensed", false)
   	end,
   })
   
   if not ok then
   	warn("[ClubKit] not starting:", result.message)
   	return
   end
   
   require(Kit.Core.Main).start(Config)

5. 5. Test without Roblox

   placeId: "0" behaves like Studio: it validates the key but never binds it.

   TerminalCopy

   curl -X POST https://arrstudioweb.vercel.app/api/licenses/verify \
     -H "Content-Type: application/json" \
     -d '{"key":"ARR-7F2K-M4QX-Q9RD","kit":"clubkit","placeId":"0"}'

Verify flow

1. 1

   Server starts

   Bootstrap calls ArrLicense.verify with Config.LicenseKey, the kit id and version.

2. 2

   POST /api/licenses/verify

   The API checks the key format and rate limits (30/min per key, 120/min per IP).

3. 3

   Transaction in Firestore

   Key exists? Active? Right kit? If the key has no place yet, it binds to this place.

4. 4

   Response

   valid: true + latestVersion. The module warns in the output if a newer version is available.

5. 5

   Every 30 minutes

   The module re-checks in the background and calls onRevoked only when the key is explicitly rejected.

Handling results in Lua

Security

• Call the API only from the server. Keep the key out of ReplicatedStorage and LocalScripts.
• A key binds to one place, so a leaked key doesn't work in someone else's game.
• Binding runs in a Firestore transaction — two servers starting at once can't bind one key to two places.
• The browser only reads data allowed by firestore.rules; all writes go through this API.

Licensing (Roblox)

The only endpoint a kit calls. No login — the license key is the credential.

{
  "key": "ARR-7F2K-M4QX-Q9RD",
  "kit": "clubkit",
  "placeId": "13284790215",
  "jobId": "a1b2c3d4-…",
  "version": "1.2.0"
}

{
  "valid": true,
  "kit": "clubkit",
  "placeId": "13284790215",
  "studio": false,
  "newlyBound": false,
  "latestVersion": "1.2.0",
  "checkedAt": "2026-09-29T10:01:00.000Z"
}

Authentication

The website uses an httpOnly __session cookie. Other clients can send Authorization: Bearer <Firebase ID token>.

{ "idToken": "eyJhbGciOi…", "displayName": "kyzo_dev" }

{ "user": { "uid": "abc123", "email": "you@studio.com", "role": "user", … } }

{ "ok": true }

{ "token": "eyJhbGciOi…" }

Account & licenses

{ "user": { "uid": "abc123", "displayName": "kyzo_dev", "robloxUsername": null, "role": "user", … } }

{ "displayName": "Kyzo", "robloxUsername": "kyzo_dev" }

{
  "licenses": [
    {
      "key": "ARR-7F2K-M4QX-Q9RD",
      "kit": "clubkit",
      "kitName": "ClubKit Pro",
      "places": ["13284790215", "98765432101"],
      "maxPlaces": 3,
      "status": "active",
      "lastKitVersion": "1.2.0",
      "verifyCount": 184,
      "releaseAvailableAt": null
    }
  ]
}

Admin

Requires a user with role "admin". Every change is pushed to the site and dashboards in realtime.

{
  "id": "summitkit",
  "name": "Summit Kit",
  "tag": "Live events",
  "tagline": "Run launches like a festival.",
  "description": "Stage control, lighting presets, …",
  "version": "1.0.0",
  "price": 299000,
  "status": "active",
  "icon": "mountain",
  "features": ["Stage & lighting presets"],
  "integrations": ["Group ranks", "Gamepasses"],
  "attributes": { "systems": 85, "integration": 90, "setup": 92 },
  "configPath": "SummitKit/Config",
  "rating": 4.8,
  "order": 2
}

{ "version": "1.3.0", "price": 349000 }

{ "kit": "summitkit", "ownerEmail": "buyer@studio.com", "count": 1, "note": "Order #1042" }

{ "keys": ["ARR-H7KQ-2MXP-9TVA"] }

{ "status": "revoked" }  // or { "maxPlaces": 5 }

{ "bundleEnabled": true, "bundlePrice": 599000, "bundlePlaces": 3 }

Error codes

Every error has the same shape. Match on code; show message to people.

{
  "error": {
    "code": "PLACE_MISMATCH",
    "message": "This license is bound to a different place.",
    "boundPlaceId": "13284790215"
  }
}