Roblox oauth

Skill TabooHarmony/roblox-brain/skills/roblox-oauth

Give your AI coding agent a Roblox brain. Curated skills for Roblox Studio development.

Install

npx -y skills add TabooHarmony/roblox-brain --skill roblox-oauth

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when implementing Roblox OAuth 2.0 for Open Cloud, including app registration, PKCE, token exchange, refresh, revocation, or scopes.

SKILL.md

2.6 KB, as published. Nobody here has run it

roblox-oauth

When to Load

Load this skill when the task centers on Roblox OAuth 2.0 delegated authorization for Open Cloud — app registration, authorization code flow with PKCE, token exchange/refresh/revocation, scope selection, or OAuth-specific error debugging. Skip it for API-key automation, in-experience scripting, or general Open Cloud endpoint work (use roblox-cloud instead).

Quick Reference

Flow Selection

Auth Code + PKCE — required for public clients (browser/mobile), recommended for all.
Confidential — backend holds client_secret; never expose in frontend code.
Public — no secret; PKCE mandatory.

PKCE Essentials

Generate code_verifier (43–128 char random) + code_challenge (SHA-256, base64url).
Send code_challenge + code_challenge_method=S256 in authorize; send code_verifier in token exchange.
One verifier per authorization attempt.

Authorization URL

GET https://apis.roblox.com/oauth/v1/authorize Params: client_id, redirect_uri, scope, response_type=code, code_challenge, code_challenge_method=S256, state, optional nonce.

Token Exchange

POST /oauth/v1/token — application/x-www-form-urlencoded Params: grant_type=authorization_code, code, client_id, code_verifier (public) or client_secret (confidential).

Token Lifecycle

Auth code — seconds, single-use; exchange immediately.
Access token — ~15 min; use as Bearer.
Refresh token — ~90 days; single-use per refresh. Replace stored token atomically after each refresh.
Revoke: POST /oauth/v1/token/revoke on disconnect.

Scope Selection

Minimum scopes matching actual endpoint needs.
openid → ID token; profile only if profile claims needed.
Medium/high/critical risk = least-privilege review signal.
Changing scopes requires reauthorization.

Validation Endpoints

GET /oauth/v1/userinfo — identity claims.
POST /oauth/v1/token/introspect — token activity (not resource auth).
POST /oauth/v1/token/resources — resource-level access.

Key Rules

Verify state before using returned code.
Refresh tokens: server-side only.
PKCE even for confidential clients.
Don't mix API keys and OAuth. Need more detail? Load references/full.md for the complete reference with code examples, API tables, and edge cases.