Roblox Open Cloud and HttpService

Base URL: https://apis.roblox.com. Prefer Open Cloud endpoints (API key or OAuth 2.0, stable). Legacy cookie-authenticated *.roblox.com web APIs can break without notice — don't build on them.

Authentication

• API keys (Creator Dashboard → Open Cloud → API Keys): for your own/your group's resources and automation. Grant the minimum scopes per universe, set an IP allowlist (CIDR) and expiration, store as a secret (CI secret, vault), send as header x-api-key: <key>. Group-owned resources need a key created under the group. Introspect a key with POST /api-keys/v1/introspect.
• OAuth 2.0 (authorization code + PKCE): apps acting on behalf of other users (third-party tools).
• Never ship keys in game scripts, attributes, or client code.

Common endpoints (v2 unless noted)