Section

API Reference

Use the public javascript-obfuscator package for CLI and Node.js builds. It handles streaming and large uploads. Direct REST clients must implement the protocol below.

Watch

Using the Obfuscator.io API: API Keys, npm Package, CLI and Custom Presets

Watch on YouTube

Create an API key under Settings → API Keys. Pro, Team, or Business access is required. Keep the key on your server or CI secret store, never in browser code. The javascript-obfuscator package takes the key as apiToken (--pro-api-token on the CLI); a direct REST request sends it in the Authorization: Bearer header. On a Team or Business plan, the team owner can tick Team service token in the Create API Key dialog; that key belongs to the team rather than to a person, so it keeps working when members leave.

API Keys · Using the NPM Package

Request

POST https://obfuscator.io/api/v1/obfuscate

Send JSON with code and options. Enable at least one Pro feature: vmObfuscation: true or parseHtml: true. Pin the version query parameter for repeatable builds; omitting it uses the latest version. It accepts an exact version such as 8.0.0, or a range: ^8.0.0 follows new minor and patch releases of 8.x, ~8.0.0 follows patch releases of 8.0.x, and a range resolves to the highest matching release. Ranges require a Team or Business plan.

options lists the options themselves; a preset name in optionsPreset is not applied. To build with a preset, built-in or custom, fetch its options from the presets endpoint in a separate request and send them as options.

If the team owner enforces a version or a preset, it overrides the request's version or options for team members and team service tokens. See Enforcing a Version and Shared Presets.

Header	Value
`Content-Type`	`application/json`
`Authorization`	`Bearer YOUR_API_KEY`

Code

Response

Read the body as newline-delimited JSON (NDJSON). A network read can split a JSON line or a UTF-8 character. Progress is not completion: require a result or chunk_end message, and retain warnings.

Small output arrives in a single result message. Large output arrives as chunk messages followed by chunk_end. Both terminal messages carry version, the concrete obfuscator version that produced the output (useful when you requested a range or the team enforces a version). warnings lists non-fatal obfuscation warnings as { type, message, functionName? } and is omitted when there are none, so treat a missing field as an empty list. Source maps are not produced for VM builds or for HTML input. A parseHtml build of plain JavaScript with sourceMap: true returns one in the sourceMap field of the terminal message, or as sourceMap chunks when it is large.

Application failures arrive as error messages inside the stream, usually with HTTP 200. Check both the HTTP status and streamed errors. Infrastructure and upload endpoints can return non-2xx HTTP responses.

Code

Code

JSON

Node.js (.mjs)

JavaScript

Code

Presets

GET https://obfuscator.io/api/v1/presets/{name}

Returns a preset's options, ready to send as the obfuscate request's options. Send the same Authorization: Bearer header. The name is matched case-insensitively, and the response is a single JSON object, not a stream. The examples below are abbreviated.

Built-in presets: {name} is a built-in preset such as vm-default (see Choosing Presets). The version query parameter selects the obfuscator version whose preset is returned; it accepts the same values as the obfuscate endpoint and defaults to the latest version. description and updatedAt are null.
Custom presets: {name} is the API alias set in a custom preset's save dialog in the dashboard, and options is the saved configuration (every option, not only the ones changed from a preset). Visibility follows the dashboard: an API key resolves its user's own presets plus the ones shared by that user's team owner, and a team service token resolves the owner's presets.

GET https://obfuscator.io/api/v1/presets/vm-default

JSON

GET https://obfuscator.io/api/v1/presets/production

JSON

Status	Meaning
200	The preset.
400	The name is malformed (1-20 characters, letters a-z, digits, hyphens or underscores, starting with a letter or digit), or the `version` is not supported.
401	Missing, invalid or expired API key.
403	Account suspended, no active subscription, or a plan without API access.
404	No built-in preset with this name in the requested version, and no custom preset with this alias visible to the key.
429	Rate limited; the request shares the per-user and per-IP budgets in Limits and failures.
500	The preset lookup failed on the server. Retry later.

Errors are {"error": "..."}. Usage examples for the javascript-obfuscator package and its CLI are in Using the NPM Package.

Limits and failures

Plan limits apply to source size and usage. Keep the complete serialized JSON body, including escaping and options, under 4.4 MB. Larger sources need temporary uploads, which are available on Team and Business through the javascript-obfuscator package only. Check your current plan limits in the dashboard.

The API allows 30 requests per minute per user, shared across their keys, and 100 requests per minute per IP. Preset requests count toward the same budgets as obfuscation requests.

Rate limiting, quota failures, and interrupted streams must stop the build. Retry deliberately; a repeated request can consume additional usage. Do not publish partial output.

Previous

Options Reference