Developer documentation

Install the SDK, create a key, and ship live Roblox infrastructure.

This is the canonical implementation guide for Roblox APIs v1: authentication, Studio setup, endpoint behavior, error handling, storage quotas, and operational conventions.

v1 Live

Base URL

https://robloxapis.com

All production routes require a live API key. Browser account sessions are separate from in-game API authentication.

Quickstart

Render live API data inside Roblox Studio.

1
Create an account, verify email, set a password, and enable Google Authenticator from Security.
2
Create a live key from Keys. The raw key is shown once, then stored only as a hash on the VPS.
3
Add the Lua SDK as a ModuleScript named RobloxAPIs in ServerScriptService.
4
Use SetExperienceConfig and ApplyExperienceConfigSign to save and render a live payload.

local RobloxAPIs = require(script.RobloxAPIs)

local client = RobloxAPIs.new("rba_sk_live_your_key")

client:SetExperienceConfig("studio-sign", {
  title = "Roblox APIs Live",
  message = "Fetched from robloxapis.com",
  accent = "#7C5CFF",
  variant = "event"
})

client:ApplyExperienceConfigSign("studio-sign")

Install SDK

Roblox Lua ModuleScript

The SDK is hosted at /sdk/robloxapis.lua. Paste it into a ModuleScript named RobloxAPIs. Server-side placement is recommended so live keys never enter client scripts.

Placement

ServerScriptService

Use server scripts for authenticated calls. Never expose production keys to LocalScripts.

Network

HttpService

Enable HTTP requests for the experience before using live API routes.

Version

v1 Routes

All current SDK methods target /api/v1/... and return JSON.

Authentication

API keys are separate from website sessions.

In-game requests authenticate with either an Authorization bearer token or an X-API-Key header.

Authorization: Bearer rba_sk_live_your_key
X-API-Key: rba_sk_live_your_key

Control	Behavior
One-time reveal	Raw keys are shown only at creation time.
Hashing	Keys are stored as HMAC hashes using the server secret.
2FA gate	Key creation requires Google Authenticator enabled.
Per-key metrics	Requests, storage usage, and last-used timestamps are tracked per key.

Physically testable API

Experience Config API

This API stores a live configuration payload and reads it back from Roblox Studio. The SDK helper can render that payload onto a sign so the test is visible in the game world.

client:SetExperienceConfig("studio-sign", {
  title = "Roblox APIs Live Test",
  message = "Fetched live from robloxapis.com",
  accent = "#20E3B2",
  variant = "success"
})

local rendered, err = client:ApplyExperienceConfigSign("studio-sign", {
  position = Vector3.new(0, 6, 0)
})

API reference

Current v1 routes

Method	Route	Purpose
PUT	`/api/v1/experience/configs/{configKey}`	Store live config for Studio or game servers.
GET	`/api/v1/experience/configs/{configKey}`	Fetch stored config payload.
POST	`/api/v1/cross-ban/check`	Check moderation state for a Roblox user.
POST	`/api/v1/cross-ban/bans`	Create or update an active ban record.
GET	`/api/v1/intel/users/{userId}`	Read risk and policy metadata for a player.
PUT	`/api/v1/vault/objects/{objectKey}`	Store arbitrary JSON against the API key owner.
POST	`/api/v1/economy/signals`	Archive an economy event and risk score.
POST	`/api/v1/webhooks/events`	Store live ops events for downstream delivery.
PATCH	`/api/v1/groups/{groupId}/policy`	Store group policy and role sync configuration.

Errors

Every failure returns JSON.

{
  "ok": false,
  "error": "invalid_api_key"
}

Status	Error	Meaning
400	`invalid_json`	The request body could not be parsed.
401	`invalid_api_key`	The key is missing, revoked, or unknown.
413	`storage_quota_exceeded`	The write would exceed the key storage quota.
429	`api_rate_limited`	The plan's per-minute limit was exceeded.
500	`api_internal_error`	The request failed unexpectedly.

Security

Operational security rules for Roblox games.

Keys

Server only

Never place live keys in LocalScripts, public assets, or client-delivered modules.

Rotation

Rotate on leak

Revoke exposed keys from the dashboard and create a replacement key.

Audit

Review usage

Request logs, storage usage, and audit events make suspicious traffic visible.

Release process

Versioned routes, documented changes, and visible status.

Breaking API changes should ship under a new version path. Non-breaking SDK helpers can be added to the hosted Lua and JS SDKs. Product-facing changes are tracked in the changelog and service availability is summarized on the status page.

Read Changelog View Status