sign in
new

apinew

key system endpoints

make, revoke and extend key system keys from code: sell keys from your store.

make, look up, revoke and extend the keys of your key systems from your own code. the usual reason: you sell access, and your store should hand every buyer a fresh key without you opening the dashboard. the basics (api keys, rate limits, errors) are on rest api.

all endpoints

endpointdoes
POST/api/v1/scripts/:slug/keysmake keys
GET/api/v1/scripts/:slug/keyslist keys
GET/api/v1/scripts/:slug/keys/:keyone key
PATCH/api/v1/scripts/:slug/keys/:keyrevoke, restore, extend, reset device, note
DELETE/api/v1/scripts/:slug/keys/:keydelete a key

a key system belongs to one script, so :slug is that script's slug (the one in its loadstring). :key is the key itself, like ZEFB-UHFG-NYCU-SZ5U (any case), so you only need to store what you gave the buyer. its numeric id works too.

selling keys from your store

point your store's purchase webhook at a small function that makes one key and sends it to the buyer. put the order id in the note, so you can find the key later (?q= searches notes).

webhook.mjsjs
// your store calls this once per purchase. check the store's signature first!
export async function onPurchase(order) {
  const res = await fetch("https://pasteblox.com/api/v1/scripts/k3m9x2p7qa/keys", {
    method: "POST",
    headers: {
      "x-api-key": process.env.PASTEBLOX_TOKEN,
      "content-type": "application/json",
    },
    body: JSON.stringify({ kind: "temporary", days: 30, note: `order ${order.id}` }),
  });
  const data = await res.json();
  if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
  return data.keys[0].key; // deliver this to the buyer
}

temporary keys start counting on their first redeem, not when they are made, so a buyer who waits a week still gets all 30 days. on a refund or chargeback, revoke the key. on a renewal, extend it.

keys

make keys

POST/api/v1/scripts/:slug/keys
auth
the owner's api key
rate limit
120 at once, then 2 per second, per account
success
201

body

kindenumrequired
temporary or lifetime.
days1–365
temporary keys: how long it lasts, counted from its first redeem. send days or hours, not both.
hours1–8760
temporary keys, instead of days.
notestring
up to 200 characters, only you see it. an order id or the buyer's name.
count1–100
how many keys, default 1. each one is different.
requestsh
curl -X POST https://pasteblox.com/api/v1/scripts/k3m9x2p7qa/keys \
  -H "x-api-key: $PASTEBLOX_TOKEN" \
  -H "content-type: application/json" \
  -d '{"kind":"temporary","days":30,"note":"order #1001"}'
response · 201json
{
  "keys": [
  {
    "id": 1310,
    "key": "ZEFB-UHFG-NYCU-SZ5U",
    "kind": "temporary",
    "status": "unused",
    "note": "order #1001",
    "durationSeconds": 2592000,
    "expiresAt": null,
    "device": null,
    "user": null,
    "useCount": 0,
    "lastUsedAt": null,
    "createdAt": "2026-10-29T13:29:54.007Z"
  }
  ]
}

keys is always a list, even with one key: take keys[0].key. if the key system has a prefix, keys start with it. see the key object for every field.

  • 404 not_foundthe script isn't yours, or it has no key system (this script has no key system).
  • 422 validation_failede.g. a temporary key without days or hours, a lifetime key with them, or count over 100.

list keys

GET/api/v1/scripts/:slug/keys
auth
the owner's api key
success
200

newest first, 50 per page. the same list as the dashboard's keys tab.

query

statusenum
unused, active, expired or revoked. leave out for all.
kindenum
checkpoint, temporary or lifetime.
qstring
part of a key, a note or a roblox name.
cursorstring
from the last page's nextCursor.
requestsh
curl "https://pasteblox.com/api/v1/scripts/k3m9x2p7qa/keys?q=order" \
  -H "x-api-key: $PASTEBLOX_TOKEN"
response · 200json
{
  "items": [
  {
    "id": 1310,
    "key": "ZEFB-UHFG-NYCU-SZ5U",
    "kind": "temporary",
    "status": "unused",
    "note": "order #1001",
    "durationSeconds": 2592000,
    "expiresAt": null,
    "device": null,
    "user": null,
    "useCount": 0,
    "lastUsedAt": null,
    "createdAt": "2026-10-29T13:29:54.007Z"
  },
    …
  ],
  "nextCursor": null
}
  • 404 not_foundthe script doesn't exist or isn't yours, or the key isn't one of this script's.

get a key

GET/api/v1/scripts/:slug/keys/:key
auth
the owner's api key
success
200

whether it's been used, when it runs out, and which device and roblox account it's locked to.

requestsh
curl https://pasteblox.com/api/v1/scripts/k3m9x2p7qa/keys/ZEFB-UHFG-NYCU-SZ5U \
  -H "x-api-key: $PASTEBLOX_TOKEN"
response · 200json
{
  "key": {
    "id": 1310,
    "key": "ZEFB-UHFG-NYCU-SZ5U",
    "kind": "temporary",
    "status": "unused",
    "note": "order #1001",
    "durationSeconds": 2592000,
    "expiresAt": null,
    "device": null,
    "user": null,
    "useCount": 0,
    "lastUsedAt": null,
    "createdAt": "2026-10-29T13:29:54.007Z"
  }
}
  • 404 not_foundthe script doesn't exist or isn't yours, or the key isn't one of this script's.

revoke, extend and more

PATCH/api/v1/scripts/:slug/keys/:key
auth
the owner's api key
rate limit
shared with making keys
success
200

send one op per request. you get the key back as it is afterwards.

bodydoes
{ "op": "revoke" }stops it working, right away. doing it twice is fine.
{ "op": "restore" }undoes a revoke.
{ "op": "extend", "days": 30 }adds time (or hours). a running key from its expiry, an expired one from now, an unused one gets a longer duration. lifetime keys stay lifetime.
{ "op": "reset_device" }unlocks it from its device, so the buyer can use it on a new one.
{ "op": "note", "note": "refunded" }replaces the note.
requestsh
curl -X PATCH https://pasteblox.com/api/v1/scripts/k3m9x2p7qa/keys/ZEFB-UHFG-NYCU-SZ5U \
  -H "x-api-key: $PASTEBLOX_TOKEN" \
  -H "content-type: application/json" \
  -d '{"op":"revoke"}'
response · 200json
{
  "key": { "key": "ZEFB-UHFG-NYCU-SZ5U", "status": "revoked", … }
}
  • 404 not_foundthe script doesn't exist or isn't yours, or the key isn't one of this script's.
  • 422 validation_failedan unknown op, or extend without days or hours.

delete a key

DELETE/api/v1/scripts/:slug/keys/:key
auth
the owner's api key
success
200

gone for good, and it stops working. to keep it in the list, revoke it instead.

requestsh
curl -X DELETE https://pasteblox.com/api/v1/scripts/k3m9x2p7qa/keys/ZEFB-UHFG-NYCU-SZ5U \
  -H "x-api-key: $PASTEBLOX_TOKEN"
response · 200json
{ "ok": true }
  • 404 not_foundthe script doesn't exist or isn't yours, or the key isn't one of this script's.

objects

key

idinteger
works in place of the key in paths.
keystring
what the player types.
kindenum
temporary or lifetime (made by you), or checkpoint (earned on the key page).
statusenum
unused, active (redeemed and running), expired or revoked.
notestring
your note, "" for none.
durationSecondsinteger | null
temporary keys: how long they last once redeemed.
expiresAtdatetime | null
when it runs out. null for lifetime keys and temporary keys nobody used yet.
devicestring | null
the first 8 characters of the device it's locked to.
userobject | null
the roblox account that last used it: { robloxUserId, robloxName }.
useCountinteger
how many times it was redeemed.
lastUsedAtdatetime | null
the last redeem.
createdAtdatetime
when it was made.