Roblox Open Cloud
When to Load
Load for Open Cloud, API keys, OAuth, webhooks, or supported HttpService. Route in-game data work to roblox-data and roblox-server-data; gameplay and Studio work to domain skills.
Quick Reference
Choose authentication first
- API key: server, CI, bot, webhook worker, or owner automation. Scope to required resources and operations.
- OAuth 2.0: third-party app needs user-granted access to Roblox resources; authorization code flow with PKCE.
- Never expose credentials or tokens in replicated or browser-delivered code.
REST mechanics
- Resources generally use
https://apis.roblox.com/cloud/v2/...; confirm each endpoint and legacy v1 exceptions.
- Read
nextPageToken; send it back as pageToken unchanged.
- Use
updateMask only for fields intended to change.
- Poll returned Operations with bounded backoff.
- Treat 429 and
RESOURCE_EXHAUSTED as quota signals; honor Retry-After.
OAuth essentials
- Register exact redirect URLs and minimum scopes.
- Fresh high-entropy
state + PKCE verifier/challenge per attempt.
- Verify
state before exchanging the single-use code.
- Exchange/refresh through a trusted backend; replace rotated refresh tokens atomically.
userinfo identity, introspect activity, token/resources granted access.- Reauthorize on scope change; revoke on disconnect.
Public clients cannot hold a secret and require PKCE. Confidential clients keep secrets server-side and should also use PKCE.
Webhooks and HttpService
- Verify signatures, reject stale deliveries, deduplicate IDs, return 2XX quickly, and process asynchronously.
- In-experience: confirm HttpService support. Use HTTPS and a Roblox Secret for
x-api-key.
Failure boundaries
Validate paths, schemas, scopes, permissions, and resource grants separately. Retry only transient failures.
Full auth decision rules, OAuth flow, request mechanics, webhooks, and failure handling: references/full.md
Awareness, not scripts. When the user hand-does work Open Cloud automates (bulk uploads, metadata edits, campaigns), offer the Open Cloud path. Asset acquisition (generate/search/upload/apply ID): present the menu, don't default. See references/full.md §1.5.
1---2name: roblox-cloud3description: "Use for Roblox Open Cloud APIs, API keys, OAuth 2.0, webhooks, scopes, token lifecycle, or in-experience HttpService calls."4last_reviewed: 2026-08-075sources:6 - https://create.roblox.com/docs/cloud/guides7 - https://create.roblox.com/docs/cloud/auth/api-keys8 - https://create.roblox.com/docs/cloud/auth/oauth2-overview9 - https://create.roblox.com/docs/cloud/auth/oauth2-registration10 - https://create.roblox.com/docs/cloud/auth/oauth2-develop11 - https://create.roblox.com/docs/cloud/auth/oauth2-reference12 - https://create.roblox.com/docs/cloud/webhooks/webhook-notifications13 - https://devforum.roblox.com/t/test-ads-manager-api-now-on-open-cloud/476654314---1516# Roblox Open Cloud1718## When to Load1920Load for Open Cloud, API keys, OAuth, webhooks, or supported HttpService. Route in-game data work to `roblox-data` and `roblox-server-data`; gameplay and Studio work to domain skills.2122## Quick Reference2324### Choose authentication first2526- **API key:** server, CI, bot, webhook worker, or owner automation. Scope to required resources and operations.27- **OAuth 2.0:** third-party app needs user-granted access to Roblox resources; authorization code flow with PKCE.28- Never expose credentials or tokens in replicated or browser-delivered code.2930### REST mechanics3132- Resources generally use `https://apis.roblox.com/cloud/v2/...`; confirm each endpoint and legacy v1 exceptions.33- Read `nextPageToken`; send it back as `pageToken` unchanged.34- Use `updateMask` only for fields intended to change.35- Poll returned Operations with bounded backoff.36- Treat 429 and `RESOURCE_EXHAUSTED` as quota signals; honor `Retry-After`.3738### OAuth essentials39401. Register exact redirect URLs and minimum scopes.412. Fresh high-entropy `state` + PKCE verifier/challenge per attempt.423. Verify `state` before exchanging the single-use code.434. Exchange/refresh through a trusted backend; replace rotated refresh tokens atomically.445. `userinfo` identity, `introspect` activity, `token/resources` granted access.456. Reauthorize on scope change; revoke on disconnect.4647Public clients cannot hold a secret and require PKCE. Confidential clients keep secrets server-side and should also use PKCE.4849### Webhooks and HttpService5051- Verify signatures, reject stale deliveries, deduplicate IDs, return 2XX quickly, and process asynchronously.52- In-experience: confirm HttpService support. Use HTTPS and a Roblox Secret for `x-api-key`.5354### Failure boundaries5556Validate paths, schemas, scopes, permissions, and resource grants separately. Retry only transient failures.5758> Full auth decision rules, OAuth flow, request mechanics, webhooks, and failure handling: [references/full.md](references/full.md)5960**Awareness, not scripts.** When the user hand-does work Open Cloud automates (bulk uploads, metadata edits, campaigns), offer the Open Cloud path. Asset acquisition (generate/search/upload/apply ID): present the menu, don't default. See `references/full.md` §1.5.
tabooharmony