Come usare
- Copia il comando e controlla il pacchetto prima di installarlo nel tuo ambiente agente.
- Controlla strumenti, credenziali e ambienti richiesti nel documento originale.
- Descrivi input e risultato desiderato; confronta l’output con le fonti.
npx skills add https://github.com/tabooharmony/roblox-brain --skill roblox-cloudPrima di iniziare
- L’installazione non include abbonamenti, quote API o accesso ai file.
- Stelle e installazioni indicano attività, non un test indipendente di qualità o sicurezza.
Documento Skill originale
Contenuto dal repository con titoli, esempi, codice, tabelle, link e immagini preservati.
Roblox Open Cloud
When to Load
Load for Open Cloud, OAuth, webhooks, HttpService, or teleport handoffs. In-game data: roblox-data and roblox-server-data.
Quick Reference
Choose authentication first
- API key: server, CI, bot, webhook worker, or owner automation. Scope to required resources and operations.
- OAuth 2.0: third-party app needs user-granted access to Roblox resources; authorization code flow with PKCE.
- Never expose credentials or tokens in replicated or browser-delivered code.
REST mechanics
- Resources generally use
https://apis.roblox.com/cloud/v2/...; confirm each endpoint and legacy v1 exceptions. - Read
nextPageToken; send it back aspageTokenunchanged. - Use
updateMaskonly for fields intended to change. - Poll returned Operations with bounded backoff.
- Treat 429 and
RESOURCE_EXHAUSTEDas quota signals; honorRetry-After.
OAuth essentials
- Register exact redirect URLs and minimum scopes.
- Fresh high-entropy
state+ PKCE verifier/challenge per attempt. - Verify
statebefore exchanging the single-use code. - Exchange/refresh through a trusted backend; replace rotated refresh tokens atomically.
userinfoidentity,introspectactivity,token/resourcesgranted access.- Reauthorize on scope change; revoke on disconnect.
Public clients cannot hold a secret and require PKCE. Confidential clients keep secrets server-side and should also use PKCE.
Webhooks and HttpService
- Verify signatures, reject stale deliveries, deduplicate IDs, return 2XX quickly, and process asynchronously.
- In-experience: confirm HttpService support. Use HTTPS and a Roblox Secret for
x-api-key.
Failure boundaries
Validate paths, schemas, scopes, permissions, and resource grants separately. Retry only transient failures.
Auth and handoff workflows: references/full.md
Awareness, not scripts. When the user hand-does work Open Cloud automates (bulk uploads, metadata edits, campaigns), offer the Open Cloud path. Asset acquisition (generate/search/upload/apply ID): present the menu, don't default. See references/full.md §1.5.
