Discord Bot + REST API + Roblox Lua Loader — Unified Platform
Note
This is a public showcase repository demonstrating the architecture, features, and capabilities of the FYY Premium system. Source code is maintained in a private repository. This repo contains documentation only.
FYY Premium is a full-stack licensing platform I built for distributing and protecting Roblox scripts. It unifies three worlds:
- A Discord bot for admins to generate, manage, and revoke license keys
- A REST API that Roblox scripts query in real-time for authentication
- A Lua loader that runs inside Roblox games with HWID + username verification
The system handles the complete lifecycle of a license — from generation and whitelisting to HWID binding, username slot management, and blacklisting.
Discord Server REST API Roblox Game
+------------------+ +------------------+ +------------------+
| | | | | |
| Admin Commands |-------->| Express Server |<--------| Lua Loader |
| User Panel | | /check | | WindUI Menu |
| Webhook Logs | | /stats | | Auto-Walk |
| | | /ping | | Player Tools |
+--------+---------+ +--------+---------+ +--------+---------+
| | |
| +--------+---------+ |
+------------------>| MongoDB |<-----------------+
| (Atlas / Local) |
+------------------+
- Service-Oriented — Business logic decoupled into specialized services (keys, HWID, settings) consumed by both bot and API
- Unified Entry Point — Single
src/app.jsboots MongoDB, Express, and Discord client in correct order - Graceful Degradation — Express server starts before bot login so platform health checks (
/,/ping) are immediately available - Connection Retry — MongoDB reconnects up to 5 times with exponential backoff on transient failures
- HWID Binding — Keys locked to a device after first use, rebind blocked until admin resets
- Username Slots — Each key supports N Roblox usernames (default 2), first-come-first-bound
- HWID Blacklist — Global device ban with in-memory
Setcache for O(1) lookups - Multi-Layer Validation — Every
/checkpasses through 7 security gates (existence, blacklist, expiry, HWID, username) - Ephemeral Responses — All bot replies are ephemeral so keys never leak to public channels
- Standard Keys — Format
FYY-XXXXX-XXXXX-XXXXX, HWID-locked, username-locked - Trial Keys — Format
TRIAL-XXXXX-XXXXX-XXXXX, hour-based expiry, no HWID lock - Bulk Operations — Generate 100 keys, whitelist a whole Discord role, bulk-update max usernames
- Auto-Bind — First N Roblox usernames to use a key get auto-registered within slot limit
| Category | Commands |
|---|---|
| Key Management | /addkey, /randomkeys, /trialkeys, /deletekey, /extendkey, /keyinfo, /keys |
| Username Management | /addusername, /removeusername, /resetusernames, /setmax, /checkusername, /slotinfo |
| User Management | /whitelist, /bulkwhitelist, /userinfo, /deleteuser |
| Blacklist & Security | /blacklistkey, /unblacklistkey, /blacklistuser, /unblacklistuser, /blacklisthwid, /unblacklisthwid, /hwidinfo, /hwidblacklist |
| Admin & Settings | /panel, /addadmin, /removeadmin, /setadminrole, /admins, /setgetrole, /webhook |
A single /panel command deploys an embed with 5 buttons:
| Button | Action | Access |
|---|---|---|
| Redeem Key | Opens modal, validates key, binds to user | Everyone |
| Get Role | Assigns premium Discord role | Key holders |
| Status | Shows key info, usernames, slots, expiration | Key holders |
| Get Script | Returns personalized loadstring |
Key holders |
| Reset Users | Clears bound usernames (24h cooldown) | Admin only |
| Endpoint | Purpose | Auth |
|---|---|---|
GET / |
Server info + feature list | Public |
GET /ping |
Health check + DB status | Public |
GET /check |
Primary validation endpoint called by Lua loader | Public |
GET /key-info |
Key details for status lookups | Public |
GET /stats |
System-wide statistics | Admin (X-API-Key) |
GET /check-hwid |
HWID blacklist check | Admin (X-API-Key) |
Once authenticated, the Lua loader provides a full WindUI-based menu:
- Authentication — Auto-login via saved token, key redemption UI
- Player Menu — WalkSpeed, Infinite Jump, NoClip, No Fall Damage, Hide Name, ESP, Anti Lag, Fly GUI
- Auto Summit — Automated expedition (Antartika) with waypoint navigation + water refill
- Auto Walk — 50+ pre-recorded mountain paths with playback, speed, loop, reverse, flip
- Animation / Teleport / Tools / Danger Zone — Additional feature tabs
Supported Auto-Walk tracks (50+)
| Track Family | Variants |
|---|---|
| Aetheria | CVIP, C2 Dontol, C2 Pro |
| Mount Age | Normal, Sline |
| Mount Astralyn | Normal, C2 |
| Mount Axis | Normal, WASD |
| Mount Bjirlah | Normal, WASD |
| Mount Gemi | Normal, CVIP, WASD |
| Mount H2C | Normal, WASD |
| Mount Serrat | Jalur 1, Jalur 2 |
| Mount Yahayuk | CVIP, Jalur 1/2/3, R6 |
| Mount YNTKTS | Dontol, Pro |
| Mount Yume | Normal, WASD |
| Other | Cinta, Date, Daun, Freestyle, Funny, Gemas, Granite, Izin, Kita, Luna, Mukjizat, Ngebut, Nightfall, Outline, Pagi, Runia V2, Sendang, Space X, Sulawesi, Vegas, Velora, Vexyria, Wayang, Yagesya, Yakuja, Yayakin |
| Layer | Technology | Purpose |
|---|---|---|
| Runtime | Node.js v18+ | Core runtime |
| Bot Framework | discord.js v14 | Slash commands, buttons, modals, interactions |
| API Framework | Express v5 | REST endpoints for Lua loader |
| Database | MongoDB + Mongoose v9 | Keys, settings, HWID blacklist |
| Logging | Winston | Structured logging (console + file) |
| Environment | dotenv | Config management with validation |
| Client | Lua (Roblox) + WindUI | In-game authentication + premium menu |
| Document | Contents |
|---|---|
| PROJECT_STRUCTURE.md | Full directory layout + layer responsibilities |
| docs/ARCHITECTURE.md | System design decisions + data flow |
| docs/API.md | REST API reference with example requests/responses |
| docs/COMMANDS.md | Complete Discord bot command reference |
| docs/SECURITY.md | Security model, validation layers, permission hierarchy |
| docs/DATABASE.md | MongoDB schema definitions |
- Real-world scale — Handles hundreds of concurrent keys, thousands of validations per day
- Battle-tested — Ran in production across multiple Roblox games
- Cross-platform architecture — Bot, API, and in-game client share the same service layer
- Clean separation — Business logic in services, presentation in commands/routes, infrastructure in models
- Developer-friendly — Modular command handlers, centralized error handling, typed embed builders
The full source code is maintained in a separate private repository. This showcase exists to demonstrate:
- System architecture and design patterns
- Feature scope and completeness
- Documentation quality and depth
For collaboration inquiries or portfolio reviews, please reach out via Discord.
Distributed under the ISC License. See LICENSE for details.
FYY Premium — Lets Fly High!
Made with 
