القائمة
Use when implementing Roblox OAuth 2.0 for Open Cloud, including app registration, PKCE, token exchange, refresh, revocation, or scopes.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when implementing Roblox character animations, particles, beams, trails, tweens, camera shake, or other visual effects.
Use when building Roblox menus, HUDs, shops, notifications, dialogs, or responsive cross-platform UI.
Use when handling Roblox keyboard, mouse, gamepad, touch, motion input, or cross-platform action binding.
Use when validating RemoteEvent or RemoteFunction arguments, adding rate limits, designing server-authoritative systems, or preventing exploits.
Use when creating Roblox NPCs or enemies with pathfinding, state machines, line-of-sight or FOV detection, spawns, or AI update loops.
Use when building Roblox vehicles, ragdolls, projectiles, elevators, constraints, forces, or other physics-driven gameplay.
| name | roblox-oauth |
| description | Use when implementing Roblox OAuth 2.0 for Open Cloud, including app registration, PKCE, token exchange, refresh, revocation, or scopes. |
| last_reviewed | "2026-07-12T00:00:00.000Z" |
| sources | ["https://create.roblox.com/docs/cloud/auth/oauth2-overview"] |
Load this skill when the task centers on Roblox OAuth 2.0 delegated authorization for Open Cloud — app registration, authorization code flow with PKCE, token exchange/refresh/revocation, scope selection, or OAuth-specific error debugging. Skip it for API-key automation, in-experience scripting, or general Open Cloud endpoint work (use roblox-cloud instead).
client_secret; never expose in frontend code.code_verifier (43–128 char random) + code_challenge (SHA-256, base64url).code_challenge + code_challenge_method=S256 in authorize; send code_verifier in token exchange.GET https://apis.roblox.com/oauth/v1/authorize
Params: client_id, redirect_uri, scope, response_type=code, code_challenge, code_challenge_method=S256, state, optional nonce.
POST /oauth/v1/token — application/x-www-form-urlencoded
Params: grant_type=authorization_code, code, client_id, code_verifier (public) or client_secret (confidential).
POST /oauth/v1/token/revoke on disconnect.openid → ID token; profile only if profile claims needed.GET /oauth/v1/userinfo — identity claims.POST /oauth/v1/token/introspect — token activity (not resource auth).POST /oauth/v1/token/resources — resource-level access.state before using returned code.references/full.md for the complete reference with code examples, API tables, and edge cases.