roblox-open-cloud

Official sources (always check these for the latest):

• https://create.roblox.com/docs/en-us/cloud (API reference index)
• https://create.roblox.com/docs/en-us/cloud/auth/api-keys (API key management)
• https://create.roblox.com/docs/cloud/auth/oauth2-overview (OAuth 2.0)
• https://create.roblox.com/docs/en-us/cloud-services/http-service (in-experience calls)
• https://create.roblox.com/docs/en-us/cloud/reference/rate-limits
• https://create.roblox.com/docs/en-us/cloud/webhooks/webhook-notifications

Open Cloud is the REST API surface for Roblox resources. It lets you build command-line tools, web apps, CI/CD pipelines, scheduled jobs, and external automation that read and write the same resources your live game servers use — without spinning up a game server.

Cross-reference:

• roblox-datastores/SKILL.md — in-engine DataStore API; Open Cloud Data Stores is the external counterpart.
• roblox-gamepasses/SKILL.md — game passes, developer products, and subscriptions also have Open Cloud management endpoints.
• roblox-networking/SKILL.md — for in-experience HTTP via HttpService and the security model around outbound requests.
• roblox-core/SKILL.md — services, HttpService, script contexts.

When to use this skill

Activate when:

• Building external automation that reads/writes Roblox resources (data stores, places, assets, groups, users).
• Implementing CI/CD for place publishing or asset upload.
• Doing bulk data operations (migration, cleanup, RTBF deletion, snapshot/restore) at a scale that's painful from in-engine scripts.
• Receiving webhook notifications (subscription purchased/refunded/renewed, etc.).
• Calling Open Cloud endpoints from inside a live game server via HttpService (e.g. updating a group membership from in-experience).
• Managing API keys, OAuth 2.0 clients, or secrets for Roblox automation.

Do not use Open Cloud for what the in-engine API already does well inside a running server (normal DataStore reads/writes, Marketplace prompts, etc.). Use it for the things the engine can't do: external triggers, bulk ops, cross-experience tooling, scheduled jobs, and webhooks.

Authentication

Three auth models, in order of preference:

1. API keys (recommended for most automation)

All Open Cloud APIs accept an x-api-key header containing an API key string. Create keys on the Creator Dashboard → API Keys page.

• A key's access is determined by the permissions of the user who owns it — it can reach any resource that user can, including their personal experiences and any group-owned experiences where they have the right role.
• Some scopes can be restricted to specific experiences; not all.
• Best practices (from the official docs):
• Create separate keys per application to isolate blast radius.
• Select the minimum permissions needed; restrict scope to specific experiences where possible.
• Use IP restrictions (CIDR notation) — but not when calling from Roblox game servers (Roblox server IPs aren't known/predictable).
• Set expiration dates for short-term keys; avoid them for long-term use without a rotation process.
• Never store keys in source control, scripts, or public channels. Use a secrets manager; in Roblox places use a Secrets Store.
• For group-owned resources, create a dedicated alternate account with only the target group access and generate the key there — don't use your personal account's key for group automation.

2. OAuth 2.0 (for apps acting on behalf of other users)

Use OAuth 2.0 when your app needs to act on behalf of a Roblox user who isn't you (e.g. a third-party tool a creator logs into). See https://create.roblox.com/docs/cloud/auth/oauth2-overview. Has stronger stability guarantees and regular updates.

3. Legacy cookie auth (avoid)

Legacy APIs use cookie-based auth, can break without notice, and have minimal stability guarantees. Not recommended for production. Only use for one-off internal tooling where breakage is acceptable.

API key lifecycle

API keys have these statuses (from the official docs):

The 60-day auto-expiry is the most common surprise: keys you set up and forget will silently stop working. Either use them regularly or build a rotation/reminder process.

Introspect endpoint

POST https://apis.roblox.com/api-keys/v1/introspect verifies whether a key is usable from the caller's IP and whether the key/user is moderated. Useful for debugging "why is my key failing":

curl --location --request POST 'https://apis.roblox.com/api-keys/v1/introspect' \
--header 'Content-Type: application/json' \
--data '{"apiKey": "your-api-key"}'

Returns the key name, authorized user, scopes (with userId/groupId/universeId/universeDatastore resource identifiers — * means all resources of that type), enabled, expired, and expirationTimeUtc.

The endpoint map

Base URL: https://apis.roblox.com/cloud/v2/... (plus a few apis.roblox.com/<feature>/v1/... legacy paths for assets). All v2 endpoints accept x-api-key.

Data & memory stores (the most-used surface)

Data stores (/cloud/v2/universes/{universe_id}/data-stores/...):

• ListDataStores, SnapshotDataStores (daily snapshot trigger).
• ListDataStoreEntries, CreateDataStoreEntry, GetDataStoreEntry, UpdateDataStoreEntry, IncrementDataStoreEntry, DeleteDataStoreEntry.
• ListDataStoreEntryRevisions (version history per entry).
• Scoped variants under /data-stores/{data_store_id}/scopes/{scope}/entries/....

Memory stores (/cloud/v2/universes/{universe_id}/memory-stores/...):

• Sorted maps: ListMemoryStoreSortedMapItems, CreateMemoryStoreSortedMapItem, GetMemoryStoreSortedMapItem, UpdateMemoryStoreSortedMapItem, DeleteMemoryStoreSortedMapItem.
• Queues: CreateMemoryStoreQueueItem, ReadMemoryStoreQueueItems, DiscardMemoryStoreQueueItems.
• FlushMemoryStore (requires universe.memory-store:flush).

Ordered data stores (/cloud/v2/universes/{universe_id}/ordered-data-stores/...):

• ListOrderedDataStoreEntries, CreateOrderedDataStoreEntry, GetOrderedDataStoreEntry, UpdateOrderedDataStoreEntry, IncrementOrderedDataStoreEntry, DeleteOrderedDataStoreEntry.

Universes & places

• GetUniverse, UpdateUniverse.
• PublishUniverseMessage (publish a message to all servers of a universe — external counterpart to MessagingService).
• RestartUniverseServers (restart all live servers of a universe).
• GetPlace, UpdatePlace (publish a place version — the CI/CD primitive).
• GetInstance, UpdateInstance.

Assets

• GetAsset, ListAssetVersions, GetAssetVersion (v1 path: apis.roblox.com/assets/v1/assets/{assetId}).
• Asset upload (images, audio, models) via the assets API — useful for batch-importing content.

Users & inventories

• GetUser, GenerateUserThumbnail.
• ListInventoryItems.

Groups

• GetGroup, ListGroupMemberships, UpdateGroupMembership, ListGroupRoles, GetGroupRole, ListGroupJoinRequests, AcceptGroupJoinRequest, DeclineGroupJoinRequest, GetGroupShout.

Monetization (cross-ref roblox-gamepasses)

• Game passes: CreateGamePass, UpdateGamePass, GetGamePassConfig, ListGamePassConfigsByUniverse.
• Developer products: CreateDeveloperProduct, UpdateDeveloperProduct, GetDeveloperProductConfig, ListDeveloperProductConfigsByUniverse.
• Subscriptions: managed via subscription endpoints; webhook events for cancelled/purchased/refunded/renewed.

Moderation & bans

• ListUserRestrictions, GetUserRestriction, UpdateUserRestriction (place- and universe-scoped), ListUserRestrictionLogs.

Luau execution

• CreateLuauExecutionSessionTask (run Luau against a universe/place from outside the engine — powerful for automation, treat as privileged).

Notifications & configs

• CreateUserNotification (send a notification to a user from outside the experience).
• Configs (CreatorConfigs): GetConfigRepositoryValues, draft/publish/revision flow for live configuration.

Creator Store

• CreateCreatorStoreProduct, GetCreatorStoreProduct, UpdateCreatorStoreProduct, CreatorStoreAssetsSearch.

See https://create.roblox.com/docs/en-us/cloud for the full, current list (new endpoints are added regularly).

Calling Open Cloud from in-experience (HttpService)

A subset of Open Cloud endpoints is callable from inside a live game server via HttpService. This is how you do things like update group memberships or kick users from external triggers without leaving the experience.

Requirements:

• Enable Allow HTTP Requests in Experience Settings.
• The API key must be stored as a Secret via the Secrets Store — retrieve it with HttpService:GetSecret("APIKey"). Never hardcode the key in a script.
• Only the x-api-key and content-type headers are allowed.
• The x-api-key value must be a Secret datatype, not a string.
• The .. string is not allowed in URL path parameters (so data stores/entries containing .. are inaccessible from HttpService).
• Only HTTPS; no ports below 1024 except 80/443; port 1194 blocked.

Rate limits (per game server):

• 2500 Open Cloud requests per minute per server. Exceeding stalls request methods for ~30 seconds and pcall may fail with "Number of Open Cloud requests exceeded limit."
• Open Cloud requests do not count against the separate 500-req/min general HTTP limit.
• Each endpoint also has a per-key-owner limit enforced regardless of where calls originate.

Example — updating a group membership from in-experience:

--!strict
local HttpService = game:GetService("HttpService")

local function updateGroupMembership(groupId: string, membershipId: string, roleId: string)
    local response
    local ok, err = pcall(function()
        response = HttpService:RequestAsync({
            Url = `https://apis.roblox.com/cloud/v2/groups/{groupId}/memberships/{membershipId}`,
            Method = "PATCH",
            Headers = {
                ["Content-Type"] = "application/json",
                ["x-api-key"] = HttpService:GetSecret("APIKey"), -- Secret, not string
            },
            Body = HttpService:JSONEncode({ role = `groups/{groupId}/roles/{roleId}` }),
        })
    end)
    if not ok then
        warn("HTTP request failed:", err)
        return false
    end
    if response.Success then
        print("Updated:", response.StatusCode, response.StatusMessage)
        return true
    end
    warn("Error:", response.StatusCode, response.StatusMessage)
    return false
end

Best practices (official): pcall everything; use exponential backoff on recoverable errors (2s → 4s → 8s); aggregate into bulk endpoints where possible; rely on HTTP/2 (automatic, but send lowercase header names). The Observability Dashboard (Creator Hub → Monitoring) shows request count and response time for your HttpService calls.

Webhooks

Open Cloud emits webhooks for certain events, including subscription events (cancelled, purchased, refunded, renewed). Set up a webhook endpoint in your app, register it via the Cloud API, and Roblox will POST event payloads to it. This is the real-time path for subscription analytics without polling GetUserSubscriptionPaymentHistoryAsync. See https://create.roblox.com/docs/en-us/cloud/webhooks/webhook-notifications.

Decision tree: in-engine vs Open Cloud

Security checklist

• [ ] Keys stored in a secrets manager or Secrets Store, never in source/scripts.
• [ ] Minimum-permission scopes; experience-restricted where possible.
• [ ] IP restrictions for non-Roblox-server callers.
• [ ] Expiration dates on short-term keys; rotation process for long-term.
• [ ] Dedicated automation account for group resources (not your personal account).
• [ ] No .. in data store keys you need to reach from HttpService.
• [ ] pcall + exponential backoff on every call.
• [ ] x-api-key passed as Secret from HttpService, not string.
• [ ] Audit key usage via the introspect endpoint and the Observability Dashboard.
• [ ] Disable/delete unused keys (they auto-expire after 60 days anyway, but don't rely on that as your only cleanup).
• [ ] Treat CreateLuauExecutionSessionTask as privileged — it runs Luau against your universe.

Common mistakes this skill prevents

• Using legacy cookie-auth APIs for production (they break without notice).
• Storing API keys in scripts or source control.
• Using a personal account's key for group automation (compromises all your resources if the key leaks).
• Hitting the 2500-req/min HttpService Open Cloud limit by not batching.
• Expecting .. in data store keys to work from HttpService (it doesn't).
• Forgetting the 60-day auto-expiry and having automation silently break.
• Using Open Cloud for things the in-engine API already does (unnecessary external dependency and latency).

How to proceed

1. Identify whether the task is in-engine or external. If external, Open Cloud.
2. Create an API key with the minimum scopes for the task. If group-owned, use a dedicated account.
3. Store the key in a Secrets Store if calling from HttpService; otherwise in your secrets manager.
4. Test with the introspect endpoint and a single GET.
5. Build the workflow with pcall + backoff. For bulk, prefer batch endpoints.
6. Set up webhooks for events you want in real time (subscriptions).
7. Monitor via the Observability Dashboard; rotate/replace keys before they auto-expire.

Sources

• https://create.roblox.com/docs/en-us/cloud
• https://create.roblox.com/docs/en-us/cloud/auth/api-keys
• https://create.roblox.com/docs/cloud/auth/oauth2-overview
• https://create.roblox.com/docs/en-us/cloud-services/http-service
• https://create.roblox.com/docs/en-us/cloud/reference/rate-limits
• https://create.roblox.com/docs/en-us/cloud/webhooks/webhook-notifications
• https://create.roblox.com/docs/en-us/cloud-services/secrets