Should I use a server script for this GUI puzzle thingy

I want to make this timing-based system, where a GUI text appears on your screen telling you which button you need to press, and for each time you have to press the key that it says fast enough. There are two mistakes you could make with this

  1. You’re too slow, so you fail the sequence
  2. You pressed the wrong button, maybe bc you fat fingered, so you fail the sequence

In order for the client to know what button to press in the first place, the server needs to send that information to the client through a remote event, like

event:FireClient(player, targetKey)

And then the client would take the targetKey and make the GUI for it and stuff.

Then the client would fire back to the server, passing in what key they just pressed, as well as the time marker (maybe)

The problem I realized is that exploiters would just be able to take the targetKey they just got from the server, and just send that back to the server since they can fire remote events and pass whatever they want, which would completely prevent mistake 2 from ever happening.

And that’s why I ask: Should I just skip sending the targetKey through the remote event, and use a server script to just change the client’s GUI directly and set the text up from there? Is that even possible? idk what to do

All GUI’s, just like all locally owned objects are controlled by the client, thus they have full control over it. server scripts also cannot change the GUI’s of other players. All data sent from client to sever can be manipulated to their liking, so checking if someone is an exploiter just based on how much time has passed is near impossible. I know that anti-exploits can never be 100%, plus they can be (somewhat) easily avoided if they are client sided, but unless you are making a competitive-based game that involves random players, I wouldn’t worry about it. (even though it seems to me that’s what you might be thinking of)

It’s the key that they press that I’m worried about and yes, that is exactly what I am making ish

Should I just go for it then with my original method?

By original method you mean use a server script to control the keys that the player must press, you can’t because the server (along with server scripts) cannot control or even see GUI’s. if you are genuinely afraid that exploiters will ruin the game for everyone, you should consider how drastic their actions will change the course of the game, and how best you can predict the performance of players based off their previous runs to find cheaters.

No I mean the local method one