SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsroblox-oauth

roblox-oauth

General & other

View repository

Updated 10-15 22:32

About this skill

roblox-oauth

When to Load

Load this skill when the task centers on Roblox OAuth 2.0 delegated authorization for Open Cloud — app registration, authorization code flow with PKCE, token exchange/refresh/revocation, scope selection, or OAuth-specific error debugging. Skip it for API-key automation, in-experience scripting, or general Open Cloud endpoint work (use roblox-cloud instead).

Quick Reference

Flow Selection

  • Auth Code + PKCE — required for public clients (browser/mobile), recommended for all.
  • Confidential — backend holds client_secret; never expose in frontend code.
  • Public — no secret; PKCE mandatory.

PKCE Essentials

  • Generate code_verifier (43–128 char random) + code_challenge (SHA-256, base64url).
  • Send code_challenge + code_challenge_method=S256 in authorize; send code_verifier in token exchange.
  • One verifier per authorization attempt.

Authorization URL

GET https://apis.roblox.com/oauth/v1/authorize Params: client_id, redirect_uri, scope, response_type=code, code_challenge, code_challenge_method=S256, state, optional nonce.

Token Exchange

POST /oauth/v1/token — application/x-www-form-urlencoded Params: grant_type=authorization_code, code, client_id, code_verifier (public) or client_secret (confidential).

Token Lifecycle

  • Auth code — seconds, single-use; exchange immediately.
  • Access token — ~15 min; use as Bearer.
  • Refresh token — ~90 days; single-use per refresh. Replace stored token atomically after each refresh.
  • Revoke: POST /oauth/v1/token/revoke on disconnect.

Scope Selection

  • Minimum scopes matching actual endpoint needs.
  • openid → ID token; profile only if profile claims needed.
  • Medium/high/critical risk = least-privilege review signal.
  • Changing scopes requires reauthorization.

Validation Endpoints

  • GET /oauth/v1/userinfo — identity claims.
  • POST /oauth/v1/token/introspect — token activity (not resource auth).
  • POST /oauth/v1/token/resources — resource-level access.

Key Rules

  • Verify state before using returned code.
  • Refresh tokens: server-side only.
  • PKCE even for confidential clients.
  • Don't mix API keys and OAuth. Need more detail? Load references/full.md for the complete reference with code examples, API tables, and edge cases.