菜单
Use when implementing Roblox OAuth 2.0 for Open Cloud, including app registration, PKCE, token exchange, refresh, revocation, or scopes.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when implementing Roblox character animations, particles, beams, trails, tweens, camera shake, or other visual effects.
Use when building Roblox menus, HUDs, shops, notifications, dialogs, or responsive cross-platform UI.
Use when handling Roblox keyboard, mouse, gamepad, touch, motion input, or cross-platform action binding.
Use when validating RemoteEvent or RemoteFunction arguments, adding rate limits, designing server-authoritative systems, or preventing exploits.
Use when creating Roblox NPCs or enemies with pathfinding, state machines, line-of-sight or FOV detection, spawns, or AI update loops.
Use when building Roblox vehicles, ragdolls, projectiles, elevators, constraints, forces, or other physics-driven gameplay.
| name | roblox-oauth |
| description | Use when implementing Roblox OAuth 2.0 for Open Cloud, including app registration, PKCE, token exchange, refresh, revocation, or scopes. |
| last_reviewed | "2026-07-12T00:00:00.000Z" |
| sources | ["https://create.roblox.com/docs/cloud/auth/oauth2-overview"] |
Load this skill when the task centers on Roblox OAuth 2.0 delegated authorization for Open Cloud — app registration, authorization code flow with PKCE, token exchange/refresh/revocation, scope selection, or OAuth-specific error debugging. Skip it for API-key automation, in-experience scripting, or general Open Cloud endpoint work (use roblox-cloud instead).
client_secret; never expose in frontend code.code_verifier (43–128 char random) + code_challenge (SHA-256, base64url).code_challenge + code_challenge_method=S256 in authorize; send code_verifier in token exchange.GET https://apis.roblox.com/oauth/v1/authorize
Params: client_id, redirect_uri, scope, response_type=code, code_challenge, code_challenge_method=S256, state, optional nonce.
POST /oauth/v1/token — application/x-www-form-urlencoded
Params: grant_type=authorization_code, code, client_id, code_verifier (public) or client_secret (confidential).
POST /oauth/v1/token/revoke on disconnect.openid → ID token; profile only if profile claims needed.GET /oauth/v1/userinfo — identity claims.POST /oauth/v1/token/introspect — token activity (not resource auth).POST /oauth/v1/token/resources — resource-level access.state before using returned code.references/full.md for the complete reference with code examples, API tables, and edge cases.