Developer documentation

NTT OBF API

Integrate Lua obfuscation into your website, tool, or application. The API accepts Lua source code and returns the obfuscated result as JSON.

Public endpoint · No API key required

Base URL https://api.nttobf.com

Obfuscate Lua source

Send a JSON POST request containing the source code. The response includes the obfuscated Lua in result.

POSThttps://api.nttobf.com/obfuscatePUBLIC · CORS *

Header	Value	Required
`Content-Type`	`application/json`	Yes

Request body

JSON

{
  "code": "print(123)"
}

Successful response

HTTP 200 · JSON

{
  "result": "-- obfuscated Lua source"
}

No website allowlist is required. Browser apps on other domains can call this endpoint. It does not use cookies or browser credentials.

Code examples

Each example sends the same JSON request and checks for an HTTP error before reading the result.

JavaScript — browser or Node.js

JavaScript

const response = await fetch("https://api.nttobf.com/obfuscate", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ code: "print(123)" })
});

const data = await response.json();
if (!response.ok) {
  throw new Error(data.error || `HTTP ${response.status}`);
}

console.log(data.result);

Python — requests

Python

import requests

response = requests.post(
    "https://api.nttobf.com/obfuscate",
    json={"code": "print(123)"},
    timeout=120,
)
response.raise_for_status()
data = response.json()

print(data["result"])

cURL

Shell

curl -X POST "https://api.nttobf.com/obfuscate" \
  -H "Content-Type: application/json" \
  -d '{"code":"print(123)"}'

Queue status

Read the current queue while an obfuscation request is processing. The returned queue fields can change as jobs move through the worker.

GEThttps://api.nttobf.com/queuePUBLIC

JavaScript

const response = await fetch("https://api.nttobf.com/queue");
const data = await response.json();

console.log(data.queue);

Limits & errors

The API is public and rate-limited by the caller's IP address.

HTTP status	Meaning	What to do
`200`	Obfuscation completed.	Read the output from `result`.
`400`	Missing or invalid `code`.	Send a non-empty Lua source string.
`429`	Rate limit exceeded: up to 5 requests per IP in 60 seconds.	Wait for the time in `Retry-After`, then retry.
`502`	The VPS did not respond.	Retry later.
`503`	The obfuscation service or tunnel is offline.	Wait for the service to come back online.

Protect private code. Requests are sent to the NTT OBF service for processing. Do not include passwords, API keys, or other secrets in the source you submit.