Creator API

Automate releases, keys, analytics and webhooks with a scoped creator API token.

Create a token in Dashboard → Integrations → API tokens, choose its scopes and copy it when it is shown. See Authentication.

All endpoints are under /api/v1/creator, need Authorization: Bearer <token> and return Cache-Control: no-store.

Endpoints

Endpoint	Scope	Description
`GET /me`	any valid token	The calling token's name and scopes
`GET /projects`	`projects:read`	Your projects, any status, paginated
`GET /projects/{id}`	`projects:read`	One project
`GET /projects/{id}/releases`	`releases:read`	Releases, newest first, with changelogs
`POST /projects/{id}/releases`	`releases:write`	Publish a release
`GET /projects/{id}/releases/{releaseId}/files`	`scripts:read`	Hosted source of one release
`GET /projects/{id}/analytics?range=`	`analytics:read`	`24h`, `7d` (default), `30d`, `90d` or `all`
`GET /projects/{id}/keys`	`keys:read`	Masked keys; `state`, `page`, `pageSize`
`POST /projects/{id}/keys`	`keys:write`	Generate keys
`POST /projects/{id}/keys/{keyId}/revoke`	`keys:write`	Revoke one active key
`POST /projects/{id}/keys/{keyId}/reset-device`	`keys:write`	Clear a key's device binding
`GET /webhooks`	`webhooks:manage`	Your webhooks
`POST /webhooks`	`webhooks:manage`	Create a webhook (secret returned once)
`PATCH /webhooks/{id}`	`webhooks:manage`	Change name, URL, events, or enable/disable
`DELETE /webhooks/{id}`	`webhooks:manage`	Delete a webhook
`POST /webhooks/{id}/rotate-secret`	`webhooks:manage`	New signing secret (returned once)
`POST /webhooks/{id}/test`	`webhooks:manage`	Send a signed `webhook.test` event

Emergency controls (pause distribution, disable key acquisition, revoke all keys, rollback) are available in the dashboard only.

Publishing a release

The body is the same as the dashboard's New release form and is validated against the project's stored type (single script or loader project). A release can never overwrite an earlier one.

curl -X POST https://scriptbunker.com/api/v1/creator/projects/$PROJECT_ID/releases \
  -H "Authorization: Bearer $SCRIPTBUNKER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "version": "2.5.0",
    "code": "print(\"hello from CI\")",
    "changelog": "Fixed a crash on teleport.\nAdded a keybind."
  }'

{ "data": { "id": "6d1c…", "version": "2.5.0" } }

Publishing makes the release current (and clears any rollback), notifies people who watch the script if it is public, records it in the project's Activity and sends release.published to your webhooks.

Generating keys

curl -X POST https://scriptbunker.com/api/v1/creator/projects/$PROJECT_ID/keys \
  -H "Authorization: Bearer $SCRIPTBUNKER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "quantity": 3, "durationSeconds": 2592000, "note": "Discord purchase" }'

{
  "data": [
    { "id": "…", "key": "SBK-7QK4-MZ2P-X9DR-C3TA", "maskedKey": "SBK-****-****-****-C3TA", "expiresAt": "2026-09-20T18:00:00.000Z", "note": "giveaway winners" }
  ]
}

quantity is 1–20. durationSeconds is optional and accepts any whole-second duration from 3,600 seconds (1 hour) through 31,536,000 seconds (1 year); when omitted, the project's configured duration is used. note is optional, up to 80 characters, and only visible to you. The plaintext key is in this response only — listing keys returns masked values. The project must use ScriptBunker Keys (409 keys_not_enabled otherwise). Keys are bound to a device the first time they are validated.

This endpoint is suitable for a Discord bot, checkout webhook or private store backend. Keep the creator token on your server or in the bot's secret storage—never place it in Roblox/Luau, browser code, a public repository or a URL. A token with only keys:write can generate and manage keys but cannot read script source.

Listing keys

{
  "data": [
    { "id": "…", "maskedKey": "SBK-****-****-****-C3TA", "state": "ACTIVE", "deviceState": "UNBOUND", "source": "manual", "note": "giveaway winners", "createdAt": "…", "expiresAt": "…", "lastUsedAt": null }
  ],
  "meta": { "total": 1, "page": 1, "pageSize": 20, "counts": { "active": 1, "unused": 1, "bound": 0, "expired": 0, "revoked": 0 } }
}

Device identifiers, device hashes and IP addresses are never returned.

Authentication

How creator API tokens authenticate requests, and how they are stored.

Webhooks

Signed HTTPS callbacks for release, key, comment and report events.