API docs

Everything below is plain HTTPS + JSON. Authenticated endpoints use your login cookie (dd_token) — with curl, keep it in a cookie jar (-c/-b cookies.txt).

Run a script from an executor

Fetch any public or unlisted script (private scripts return 404). The fastest one-liner uses the raw link (served as text/plain, cached for 60s):

loadstring(game:HttpGet("https://drawdump.com/raw/<id>/<filename>"))()

Need the metadata first (game, key system, status)? Fetch the JSON, then run script — never pass JSON itself to loadstring:

local data = game:GetService("HttpService"):JSONDecode(game:HttpGet("https://drawdump.com/api/script/fetch/<id>"))
loadstring(data.script)()

Or get the plain script through the API directly with ?raw=1:

loadstring(game:HttpGet("https://drawdump.com/api/script/fetch/<id>?raw=1"))()

Reference shape of GET /api/script/fetch/<id>:

{
  "id": "d59c63c69e",
  "title": "My hub",
  "game": "Blox Fruits",
  "key_system": "keyless",
  "status": "working",
  "views": 12,
  "likes": 3,
  "script": "-- lua code here"
}

List & search scripts

GET /api/snippets?q=esp&page=1&sort=top&game=Blox%20Fruits

sort: latest (default) | top (most liked) | views (most viewed)
game: exact game name, e.g. Universal

Likes & comments

POST   /api/snippets/<id>/like          # toggle like (login)
GET    /api/snippets/<id>/comments       # list comments
POST   /api/snippets/<id>/comments       # {"body": "..."} (login + verified email)
DELETE /api/comments/<cid>                 # own comment, or any on your script

Upload & manage (login + verified email)

POST   /api/snippets                  # JSON body or multipart file
PUT    /api/snippets/<id>             # update your own script
DELETE /api/snippets/<id>             # delete your own script
POST   /api/snippets/<id>/thumbnail   # multipart "thumb" image (512 KB max)
POST   /api/auth/avatar                   # multipart "avatar" image (256 KB max)

Script fields: filename, title, description (1000 chars), language, visibility (public/unlisted/private), game, key_system (keyless/key/paid), status (working/patched/mixed), discord (discord.gg invite).

Auth

POST /api/auth/register          # {"email","password"} → 6-digit code by email
POST /api/auth/verify-code         # {"code":"123456"}
POST /api/auth/resend-verification
POST /api/auth/login               # {"email","password"}
POST /api/auth/logout
POST /api/auth/forgot-password     # {"email"} → 1-hour reset link by email
POST /api/auth/reset-password      # {"token","password"}
GET  /api/auth/me                  # current user or null

Limits