MCPInstall

roblox-open-cloud

by el4cteoBackend & APIs

Open Cloud REST APIs and HttpService - API keys/OAuth, v2 patterns, data/memory stores from outside, publishMessage, place publishing, server restarts, Luau execution, bans, configs/experiments, notifications, webhooks with roblox-signature verification, rate limits, Secrets. Use when building external tools, dashboards, bots, CI/CD, admin panels, or calling web APIs from a game.

Installs
425
Last 24h
+22
Trending rank
#5547
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/el4cteo/roblox-skills --skill roblox-open-cloud
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads roblox-open-cloud automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Roblox Open Cloud and HttpService

Base URL: https://apis.roblox.com. Prefer Open Cloud endpoints (API key or OAuth 2.0, stable). Legacy cookie-authenticated *.roblox.com web APIs can break without notice — don't build on them.

Authentication

  • API keys (Creator Dashboard → Open Cloud → API Keys): for your own/your group's resources and automation. Grant the minimum scopes per universe, set an IP allowlist (CIDR) and expiration, store as a secret (CI secret, vault), send as header x-api-key: <key>. Group-owned resources need a key created under the group. Introspect a key with POST /api-keys/v1/introspect.
  • OAuth 2.0 (authorization code + PKCE): apps acting on behalf of other users (third-party tools).
  • Never ship keys in game scripts, attributes, or client code.

Common endpoints (v2 unless noted)

TaskEndpoint
Data store entriesGET/POST /cloud/v2/universes/{u}/data-stores/{ds}/entries, GET/PATCH/DELETE .../entries/{id}, :increment, :listRevisions; scopes via /scopes/{scope}/entries
Ordered data stores/cloud/v2/universes/{u}/ordered-data-stores/{ods}/scopes/{scope}/entries[...]
Memory stores/cloud/v2/universes/{u}/memory-store/sorted-maps/{map}/items, `/queues/{q}/items[:read
Cross-server message into live serversPOST /cloud/v2/universes/{u}:publishMessage { "topic": "...", "message": "..." }
Publish a place file`POST /universes/v1/{u}/places/{p}/versions?versionType=Published
Restart servers (after an update)POST /cloud/v2/universes/{u}:restartServers
Run Luau in a cloud serverPOST /cloud/v2/universes/{u}/places/{p}[/versions/{v}]/luau-execution-session-tasks
BansPATCH /cloud/v2/universes/{u}/user-restrictions/{userId}?updateMask=gameJoinRestriction (scope universe.user-restriction:write), user-restrictions:listLogs
Experience notificationsPOST /cloud/v2/users/{userId}/notifications
Secrets store/cloud/v2/universes/{u}/secrets
Configs / experiments`/creator-configs-public-api/v1/configs/universes/{u}/repositories/{repo}[/draft
Universe/place settingsGET/PATCH /cloud/v2/universes/{u}, /cloud/v2/universes/{u}/places/{p}
Assets, badges, game passes, developer products, groups, users, inventorySee the Open Cloud reference by feature.

The authoritative list with scopes and per-endpoint rate limits is the Open Cloud reference (create.roblox.com/docs/cloud/reference) and its OpenAPI description — check it before writing a client.

Patterns

  • Pagination: pass maxPageSize; follow nextPageToken → pageToken until empty.
  • Long-running operations: some calls return an operation path; poll GET /cloud/v2/{path} until done.
  • Filtering: filter query parameter on list endpoints that support it.
  • Rate limits: read the x-ratelimit-* response headers; on 429, back off exponentially with jitter. Data store budgets are shared between Open Cloud and live game servers — throttle bulk scripts so they don't starve the game (see roblox-data-stores).
  • Errors: JSON { code, message }; retry only 429 and 5xx.
  • Legacy web APIs (cookie or unauthenticated IP): after Oct 19, 2026, limits on the badges, datastores, game-persistence, inventory, thumbnails, and users APIs drop sharply (often to 100 requests/min). Open Cloud limits don't change: use Open Cloud with an API key for tools and bots, and cache responses.
  • Thumbnails: from Oct 26, 2026 an unapproved or broken thumbnail returns 200 with a completed operation containing an error object (not 503); check error before reading response.imageUri.
# Read one player's data store entry
curl -s "https://apis.roblox.com/cloud/v2/universes/$UNIVERSE_ID/data-stores/PlayerData/entries/User_$USER_ID" \
  -H "x-api-key: $ROBLOX_API_KEY"

# Announce to all live servers (the game subscribes to the "Announcements" topic)
curl -s -X POST "https://apis.roblox.com/cloud/v2/universes/$UNIVERSE_ID:publishMessage" \
  -H "x-api-key: $ROBLOX_API_KEY" -H "Content-Type: application/json" \
  -d '{"topic":"Announcements","message":"{\"text\":\"Update in 5 minutes\"}"}'

HttpService inside games

  • Enable Allow HTTP Requests (Experience Settings → Security). Server-side only.
  • Limits: 500 requests/min per server for external URLs; Open Cloud calls have a separate 2,500/min per server budget. Always pcall; handle non-2xx (response.Success).
  • Store keys in the experience Secrets store (Creator Hub) and read with HttpService:GetSecret(name), which returns an opaque Secret usable in headers (and AddPrefix/AddSuffix), not a readable string.
  • Only a subset of Open Cloud endpoints can be called from games (assets, bans, configs, data/memory stores, messaging, notifications, and more — check the in-game HTTP docs list). Calls to other roblox.com domains are blocked.
--!strict
local HttpService = game:GetService("HttpService")

local function postToWebhook(url: string, payload: { [string]: any }): boolean
	local ok, response = pcall(function()
		return HttpService:RequestAsync({
			Url = url,
			Method = "POST",
			Headers = { ["Content-Type"] = "application/json" },
			Body = HttpService:JSONEncode(payload),
		})
	end)
	if not ok then
		warn("HTTP request failed to send:", response)
		return false
	end
	if not response.Success then
		warn(`HTTP {response.StatusCode}: {response.StatusMessage}`)
	end
	return response.Success
end

local function banViaOpenCloud(universeId: number, userId: number, reason: string): boolean
	local ok, response = pcall(function()
		return HttpService:RequestAsync({
			Url = `https://apis.roblox.com/cloud/v2/universes/{universeId}/user-restrictions/{userId}?updateMask=gameJoinRestriction`,
			Method = "PATCH",
			Headers = {
				["Content-Type"] = "application/json",
				["x-api-key"] = HttpService:GetSecret("OpenCloudKey"),
			},
			Body = HttpService:JSONEncode({
				gameJoinRestriction = { active = true, displayReason = reason, privateReason = reason },
			}),
		})
	end)
	return ok and response.Success
end

return { postToWebhook = postToWebhook, banViaOpenCloud = banViaOpenCloud }

In-game, prefer native APIs (Players:BanAsync, DataStoreService) over calling Open Cloud for the same thing. Never log or send player chat/PII to third parties without a legitimate purpose and compliance review.

Webhooks (Roblox → your server)

Configure in Creator Hub → Account Settings → Webhooks (max 5; for group games only the group owner). Triggers: subscription purchased/renewed/cancelled/refunded/resubscribed, right-to-erasure requests, commerce order paid/refunded, transaction refunded (Robux refunds/chargebacks of developer products, passes, private servers, Paid Access — revoke developer product benefits yourself). Verification details and a Node/Python verifier: references/webhooks.md.

Related skills

roblox-data-stores (budgets, schema), roblox-tooling (CI publishing), roblox-testing (Luau execution tests), roblox-analytics-liveops (configs, experiments), roblox-security (bans, secrets).

FAQ

What does the roblox-open-cloud skill do?

Open Cloud REST APIs and HttpService - API keys/OAuth, v2 patterns, data/memory stores from outside, publishMessage, place publishing, server restarts, Luau execution, bans, configs/experiments, notifications, webhooks with roblox-signature verification, rate limits, Secrets. Use when building external tools, dashboards, bots, CI/CD, admin panels, or calling web APIs from a game.

How do I install roblox-open-cloud?

Run npx skills add https://github.com/el4cteo/roblox-skills --skill roblox-open-cloud in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/roblox-open-cloud/ (personal) or .claude/skills/roblox-open-cloud/ (project).

Which AI agents can use roblox-open-cloud?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is roblox-open-cloud safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains roblox-open-cloud?

It is published by el4cteo in el4cteo/roblox-skills. It has 425 recorded installs.

More from el4cteo/roblox-skills

View all →

roblox-world-building

el4cteo/roblox-skills

Building worlds with code - parts, models and pivots, materials, Lighting (LightingStyle, Atmosphere, post-processing), day/night, Terrain API, in-game CSG and destruction (GeometryService Subtract/Union/Fragment), ProceduralModel, EditableMesh/EditableImage, particles/beams/trails/highlights. Use when creating maps, environments, lighting, destructible objects, procedural levels, or visual effects.

Backend & APIs487 installs

roblox-ui

el4cteo/roblox-skills

Responsive cross-platform UI - ScreenGui and safe areas (ScreenInsets), Scale vs Offset, UIListLayout flex/UIFlexItem, constraints, StyleSheets/tokens/themes, RichText, gamepad/touch navigation, UIDragDetector, CanvasGroup, tweens, BillboardGui/SurfaceGui, React-lua/Fusion/Vide. Use when building HUDs, menus, shops, inventories, or fixing UI that breaks on mobile, console, or other screen sizes.

Frontend & Design482 installs

roblox-luau

el4cteo/roblox-skills

Modern, type-safe Luau for Roblox, covering --!strict and the new type solver, generics, string interpolation, if-expressions, task library, require-by-string, module/OOP patterns, error handling with retries, buffer/vector, and legacy APIs to avoid. Use when writing, refactoring, or explaining any Roblox script, fixing type errors, or modernizing old Lua code.

Code Quality & Workflow474 installs

roblox-testing

el4cteo/roblox-skills

Open the skill to read its SKILL.md instructions.

Testing & QA469 installs

roblox-game-systems

el4cteo/roblox-skills

Recipes for common systems built on server authority - currency service and leaderstats, XP/levels, round loops with intermission and teams, validated melee/ranged combat, inventory and tools, soft-currency shops, obby checkpoints, daily rewards, pets. Use when implementing or reviewing gameplay systems such as rounds, combat, weapons, inventories, shops, currencies, or progression.

Media & Creative467 installs

roblox-security

el4cteo/roblox-skills

Anti-exploit design - never trust the client, validate every remote argument (NaN, spoofed instances, strings), rate limiting, ProximityPrompt/ClickDetector abuse, network ownership, movement and hit validation, economy/trade duplication, code confidentiality, secure teleports, heuristics, Ban API. Use when writing server handlers for client input, combat/economy/trading, or reviewing for exploits.

Security465 installs

Popular backend & apis skills

View category →

find-skills

vercel-labs/skills

Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.

OfficialBackend & APIs4.1M installs

entra-app-registration

microsoft/azure-skills

Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

OfficialBackend & APIs566.7K installs

google-agents-cli-adk-code

google/agents-cli

This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).

Backend & APIs514.8K installs

embedded-captions

heygen-com/hyperframes

Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.

Backend & APIs453.3K installs

entra-agent-id

microsoft/azure-skills

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).

OfficialBackend & APIs336.6K installs

neon

neondatabase/agent-skills

Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.

Backend & APIs237.1K installs