$npx -y skills add TabooHarmony/roblox-brain --skill roblox-cloudUse when working with Roblox Open Cloud REST APIs, API keys, webhooks, or HttpService calls to cloud endpoints.
| 1 | # roblox-cloud |
| 2 | |
| 3 | ## When to Load |
| 4 | |
| 5 | Load this skill when the task involves Roblox Open Cloud REST APIs, API-key authentication, webhook setup, or HttpService calls to Open Cloud endpoints. Skip it for OAuth flows (use roblox-oauth), persistent data design (use roblox-data), gameplay networking (use roblox-networking), or pure engine API lookups (use roblox-studio-mcp). |
| 6 | |
| 7 | ## Quick Reference |
| 8 | |
| 9 | ### Open Cloud REST APIs |
| 10 | - Base: `https://apis.roblox.com/cloud/v2/…` (v1 for legacy) |
| 11 | - Auth: `x-api-key: <API_KEY>` header for server-to-server |
| 12 | - Content-Type: `application/json` for bodies |
| 13 | - Pagination: read `nextPageToken`, pass it back as `pageToken` query param |
| 14 | - Update masks: use `updateMask` query param for partial PATCH |
| 15 | - Long-running ops: poll the returned Operation resource with exponential backoff |
| 16 | - Error codes: `INVALID_ARGUMENT` (bad input), `PERMISSION_DENIED`/`INSUFFICIENT_SCOPE` (auth), `RESOURCE_EXHAUSTED`/429 (rate limit → backoff), `UNAVAILABLE` (transient → retry) |
| 17 | |
| 18 | ### API Keys |
| 19 | - Use for: CI jobs, bots, web backends, in-experience automation (non-user) |
| 20 | - Each key has scoped permissions—confirm required scopes before coding |
| 21 | - Creator permissions AND key scopes must both allow the action |
| 22 | - Never store keys as plain text in experiences—use Secrets |
| 23 | |
| 24 | ### Webhooks |
| 25 | - Requires public HTTPS POST endpoint |
| 26 | - Return 2XX within 5 seconds; process event async |
| 27 | - Verify `roblox-signature` header when secret is configured |
| 28 | - Deduplicate by `NotificationId`—deliveries may repeat |
| 29 | - Reject stale timestamps |
| 30 | |
| 31 | ### HttpService Constraints (in-experience) |
| 32 | - Only certain Open Cloud endpoints are supported |
| 33 | - Allowed headers: `x-api-key`, `Content-Type` ONLY |
| 34 | - API key must come from a Secret (not plain string) |
| 35 | - HTTPS only; path params cannot contain `..` |
| 36 | - Check endpoint support before coding |
| 37 | |
| 38 | ### Handoffs |
| 39 | - OAuth / user consent → `roblox-oauth` |
| 40 | - Data schema / DataStore design → `roblox-data` |
| 41 | - Remotes / networking → `roblox-networking` |
| 42 | - Engine API lookup only → `roblox-studio-mcp` |
| 43 | |
| 44 | ### References |
| 45 | - `references/full.md` — complete instructions, decision rules, checklist, common mistakes, and examples. Use the official Creator Hub guides in frontmatter for current endpoint details. |