API Reference

Create an API key under Settings → API Keys. Pro, Team, or Business access is required. Keep the key on your server or CI secret store, never in browser code. The javascript-obfuscator package takes the key as apiToken (--pro-api-token on the CLI); a direct REST request sends it in the Authorization: Bearer header. On a Team or Business plan, the team owner can tick Team service token in the Create API Key dialog; that key belongs to the team rather than to a person, so it keeps working when members leave.

API Keys · Using the NPM Package

Request

POST https://obfuscator.io/api/v1/obfuscate

Send JSON with code and options. Enable at least one Pro feature: vmObfuscation: true or parseHtml: true, directly or through a preset. Pin the version query parameter for repeatable builds; omitting it uses the latest version. It accepts an exact version such as 8.0.0, or a range: ^8.0.0 follows new minor and patch releases of 8.x, ~8.0.0 follows patch releases of 8.0.x, and a range resolves to the highest matching release. Ranges require a Team or Business plan.

options can name a preset instead of listing every option: set optionsPreset to a built-in preset such as vm-default (see Choosing Presets) or to the API alias of a custom preset. A built-in preset is applied as the requested obfuscator version defines it, and an alias resolves with the same visibility as the presets endpoint. The preset is the base, and every other option in the request overrides it. A name that is neither fails the request with an error.

If the team owner enforces a version or a preset, it overrides the request's version or options for team members and team service tokens. See Enforcing a Version and Shared Presets.

Header	Value
Content-Type	application/json
Authorization	Bearer YOUR_API_KEY

Response

Read the body as newline-delimited JSON (NDJSON). A network read can split a JSON line or a UTF-8 character. Progress is not completion: require a result or chunk_end message, and retain warnings.

Small output arrives in a single result message. Large output arrives as chunk messages followed by chunk_end. Both terminal messages carry version, the concrete obfuscator version that produced the output (useful when you requested a range or the team enforces a version). warnings lists non-fatal obfuscation warnings as { type, message, functionName? } and is omitted when there are none, so treat a missing field as an empty list. Source maps are not produced for VM builds or for HTML input. A parseHtml build of plain JavaScript with sourceMap: true returns one in the sourceMap field of the terminal message, or as sourceMap chunks when it is large.

Application failures arrive as error messages inside the stream, usually with HTTP 200. Check both the HTTP status and streamed errors. Infrastructure and upload endpoints can return non-2xx HTTP responses.

Node.js (.mjs)

Presets

GET https://obfuscator.io/api/v1/presets/{name}

Returns a preset's options, ready to send as the obfuscate request's options. Send the same Authorization: Bearer header. The name is matched case-insensitively, and the response is a single JSON object, not a stream. The examples below are abbreviated.

• Built-in presets: {name} is a built-in preset such as vm-default (see Choosing Presets). The version query parameter selects the obfuscator version whose preset is returned; it accepts the same values as the obfuscate endpoint and defaults to the latest version. description and updatedAt are null.
• Custom presets: {name} is the API alias set in a custom preset's save dialog in the dashboard, and options is the saved configuration (every option, not only the ones changed from a preset). Visibility follows the dashboard: an API key resolves its user's own presets plus the ones shared by that user's team owner, and a team service token resolves the owner's presets.

GET https://obfuscator.io/api/v1/presets/vm-default

GET https://obfuscator.io/api/v1/presets/production

Status	Meaning
200	The preset.
400	The name is malformed (1-20 characters, letters a-z, digits, hyphens or underscores, starting with a letter or digit), or the version is not supported.
401	Missing, invalid or expired API key.
403	Account suspended, no active subscription, or a plan without API access.
404	No built-in preset with this name in the requested version, and no custom preset with this alias visible to the key.
429	Rate limited; the request shares the per-user and per-IP budgets in Limits and failures.
500	The preset lookup failed on the server. Retry later.

Errors are {"error": "..."}. Usage examples for the javascript-obfuscator package and its CLI are in Using the NPM Package.

Quota

GET https://obfuscator.io/api/v1/quota

Returns how much usage your plan has left, so a build can check that a set of files fits before it starts instead of failing partway. Send the same Authorization: Bearer header. The response is a single JSON object, not a stream, and the request itself does not count toward usage.

• remainingBytes: what you can still use right now, the smaller of what is left today and what is left this month. null when your plan has no limit.
• minBytesPerBuild: the least a single build counts.
• daily and monthly: bytes used and the limit of each window, or null when your plan has no such limit. resetsAt is when the window starts over, in ISO 8601 UTC: the daily window at 00:00 UTC, the monthly window on your billing date each month.
• On a team, a member's key reports the team's shared monthly usage and the member's own daily usage. A team service token reports the team owner's.

A build counts the size of its source in bytes (UTF-8), once, whatever options it uses, and at least minBytesPerBuild. The size of the output does not count. For an HTML file built with parseHtml, only the scripts selected for obfuscation count. Add up the builds you are about to run and compare the total with remainingBytes.

When a build is refused because a limit is used up, the stream's error message carries an errorCode:

errorCode	Meaning
dailyLimit	The daily limit is used up. Retry after daily.resetsAt.
monthlyLimit	The monthly limit is used up. Retry after monthly.resetsAt, or upgrade your plan.
usageCheckFailed	Usage could not be checked. Retry shortly.

These three codes are stable. Other errors may also carry an errorCode; do not rely on it.

Status	Meaning
200	The quota.
401	Missing, invalid or expired API key.
403	Account suspended, no active subscription, or a plan without API access.
429	Rate limited; the request shares the per-user and per-IP budgets in Limits and failures.
500	Usage could not be read. Retry later.

Limits and failures

Plan limits apply to source size and usage. Keep the complete serialized JSON body, including escaping and options, under 4.4 MB. Larger sources need temporary uploads, which are available on Team and Business through the javascript-obfuscator package only. Check your current limits and usage in the dashboard or with the quota endpoint. Only builds that return obfuscated code count toward usage; a request that ends in an error does not.

The API allows 30 requests per minute per user, shared across their keys, and 100 requests per minute per IP. Preset and quota requests count toward the same budgets as obfuscation requests.

Rate limiting, quota failures, and interrupted streams must stop the build. Retry deliberately; a repeated request can consume additional usage. Do not publish partial output.

Testing and CI