360 Secure SkillHub
360 安全技能中心

roblox-cloud

面向 Roblox Open Cloud 的参考型 Skill，讲解 API key 与 OAuth 2.0 的认证选择、scope 与令牌生命周期、Webhook 验签与重试、HttpService 调用以及游戏外访问 DataStore/消息服务的注意事项；本身不产出脚本，要求查阅最新 Open Cloud 参考确认端点与 schema。

TabooHarmony
热度 0.00
最近更新 2026-10-18 22:40:29
分类：知识依赖：纯提示词应用场景：API 集成 / 概念解释

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add tabooharmony/roblox-brain/roblox-cloud
Metadata
name
roblox-cloud
description
Use for Roblox Open Cloud: API keys, OAuth 2.0, webhooks, scopes, token lifecycle, DataStore or messaging access from outside the game.
when_to_use
Also for scripts that read stats or saves externally, publishing places by API, HttpService calls, and auditing API key permissions.
last_reviewed
"2026-10-02T00:00:00.000Z"
sources
["https://create.roblox.com/docs/projects/teleport","https://create.roblox.com/docs/cloud/guides","https://create.roblox.com/docs/cloud/auth/api-keys","https://create.roblox.com/docs/cloud/auth/oauth2-overview","https://create.roblox.com/docs/cloud/auth/oauth2-registration","https://create.roblox.com/docs/cloud/auth/oauth2-develop","https://create.roblox.com/docs/cloud/auth/oauth2-reference","https://create.roblox.com/docs/cloud/webhooks/webhook-notifications","https://devforum.roblox.com/t/test-ads-manager-api-now-on-open-cloud/4766543"]

Roblox Open Cloud

When to Load

Load for Open Cloud, OAuth, webhooks, HttpService, or teleport handoffs. In-game data: roblox-data and roblox-server-data.

Quick Reference

Choose authentication first

  • API key: server, CI, bot, webhook worker, or owner automation. Scope to required resources and operations.
  • OAuth 2.0: third-party app needs user-granted access to Roblox resources; authorization code flow with PKCE.
  • Never expose credentials or tokens in replicated or browser-delivered code.

REST mechanics

  • Resources generally use https://apis.roblox.com/cloud/v2/...; confirm each endpoint and legacy v1 exceptions.
  • Read nextPageToken; send it back as pageToken unchanged.
  • Use updateMask only for fields intended to change.
  • Poll returned Operations with bounded backoff.
  • Treat 429 and RESOURCE_EXHAUSTED as quota signals; honor Retry-After.

OAuth essentials

  1. Register exact redirect URLs and minimum scopes.
  2. Fresh high-entropy state + PKCE verifier/challenge per attempt.
  3. Verify state before exchanging the single-use code.
  4. Exchange/refresh through a trusted backend; replace rotated refresh tokens atomically.
  5. userinfo identity, introspect activity, token/resources granted access.
  6. Reauthorize on scope change; revoke on disconnect.

Public clients cannot hold a secret and require PKCE. Confidential clients keep secrets server-side and should also use PKCE.

Webhooks and HttpService

  • Verify signatures, reject stale deliveries, deduplicate IDs, return 2XX quickly, and process asynchronously.
  • In-experience: confirm HttpService support. Use HTTPS and a Roblox Secret for x-api-key.

Failure boundaries

Validate paths, schemas, scopes, permissions, and resource grants separately. Retry only transient failures.

Auth and handoff workflows: references/full.md

Awareness, not scripts. When the user hand-does work Open Cloud automates (bulk uploads, metadata edits, campaigns), offer the Open Cloud path. Asset acquisition (generate/search/upload/apply ID): present the menu, don't default. See references/full.md §1.5.