Security Guide

LD Refunds stores refunds on LD infrastructure. Your FiveM game server connects outbound only using a server token — not your license key.

Your license key is for dashboard and Discord bot access. Your server token is the secret your game server uses to sync refunds and claim them in-game.

• License owner — full license key and full server token in the dashboard.
• Discord guild admins — masked license key and masked server token only.
• Refund role members — manage refunds, but secrets stay masked.
• FiveM server — token stored in FiveM KVP after pairing (not in resource files).

• Pair from Manage → Game Server using refunds-pair <code> in your server console.
• Use Rotate token in Manage → Game Server after staff changes or if you suspect exposure.
• Use Revoke token immediately if leaked, then rotate a new one when ready.
• Keep the LD Refund resource updated for the latest security and performance improvements.

1. Open Manage → Game Server and click Revoke token.
2. Click Rotate token to generate a new one.
3. Re-pair with a new code after rotate or revoke in Manage → Game Server.
4. Review recent refunds for unexpected claims and contact LD support if needed.

A leaked license key alone cannot access the Game API or claim refunds. Still, treat it as sensitive: contact support if someone else activates it to another server, and avoid posting it publicly.

• Game API requests require a valid, active server token.
• Refund claims are transactional — only the matching Discord player can claim a pending refund, and double-claims are rejected.
• Rate limits and request logging help detect abuse.
• License keys are rejected for Game API access — use the server token only.