roblox-oauth
installsforks
How to install roblox-oauth?
tabooharmony/roblox-brain/roblox-oauth
$npx -y skills add TabooHarmony/roblox-brain --skill roblox-oauthUse when implementing Roblox OAuth 2.0 for Open Cloud, including app registration, PKCE, token exchange, refresh, revocation, or scopes.
SKILL.md
| 1 | # roblox-oauth |
| 2 | |
| 3 | ## When to Load |
| 4 | |
| 5 | Load this skill when the task centers on Roblox OAuth 2.0 delegated authorization for Open Cloud — app registration, authorization code flow with PKCE, token exchange/refresh/revocation, scope selection, or OAuth-specific error debugging. Skip it for API-key automation, in-experience scripting, or general Open Cloud endpoint work (use `roblox-cloud` instead). |
| 6 | |
| 7 | ## Quick Reference |
| 8 | |
| 9 | ### Flow Selection |
| 10 | - **Auth Code + PKCE** — required for public clients (browser/mobile), recommended for all. |
| 11 | - **Confidential** — backend holds `client_secret`; never expose in frontend code. |
| 12 | - **Public** — no secret; PKCE mandatory. |
| 13 | |
| 14 | ### PKCE Essentials |
| 15 | - Generate `code_verifier` (43–128 char random) + `code_challenge` (SHA-256, base64url). |
| 16 | - Send `code_challenge` + `code_challenge_method=S256` in authorize; send `code_verifier` in token exchange. |
| 17 | - One verifier per authorization attempt. |
| 18 | |
| 19 | ### Authorization URL |
| 20 | `GET https://apis.roblox.com/oauth/v1/authorize` |
| 21 | Params: `client_id`, `redirect_uri`, `scope`, `response_type=code`, `code_challenge`, `code_challenge_method=S256`, `state`, optional `nonce`. |
| 22 | |
| 23 | ### Token Exchange |
| 24 | `POST /oauth/v1/token` — `application/x-www-form-urlencoded` |
| 25 | Params: `grant_type=authorization_code`, `code`, `client_id`, `code_verifier` (public) or `client_secret` (confidential). |
| 26 | |
| 27 | ### Token Lifecycle |
| 28 | - **Auth code** — seconds, single-use; exchange immediately. |
| 29 | - **Access token** — ~15 min; use as Bearer. |
| 30 | - **Refresh token** — ~90 days; single-use per refresh. Replace stored token atomically after each refresh. |
| 31 | - **Revoke**: `POST /oauth/v1/token/revoke` on disconnect. |
| 32 | |
| 33 | ### Scope Selection |
| 34 | - Minimum scopes matching actual endpoint needs. |
| 35 | - `openid` → ID token; `profile` only if profile claims needed. |
| 36 | - Medium/high/critical risk = least-privilege review signal. |
| 37 | - Changing scopes requires reauthorization. |
| 38 | |
| 39 | ### Validation Endpoints |
| 40 | - `GET /oauth/v1/userinfo` — identity claims. |
| 41 | - `POST /oauth/v1/token/introspect` — token activity (not resource auth). |
| 42 | - `POST /oauth/v1/token/resources` — resource-level access. |
| 43 | |
| 44 | ### Key Rules |
| 45 | - Verify `state` before using returned code. |
| 46 | - Refresh tokens: server-side only. |
| 47 | - PKCE even for confidential clients. |
| 48 | - Don't mix API keys and OAuth. |
| 49 | **Need more detail?** Load `references/full.md` for the complete reference with code examples, API tables, and edge cases. |
People who liked this also viewed
6 picksType
- hyperframes-cliUse the HyperFrames CLI development loop: init, add, catalog, capture, lint, check, snapshot, compare, grade-compare, preview, play, present, beats, keyframes, single or batch render, publish, cloud, SkillsJul 2026
- request-refactor-planSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- analyze-projectRigor Analyze / Rigor Audit read-only skill for deep learning research repositories. Use when the user wants to read and understand a repository, inspect model structure and training or inference entrSkillsMay 2026
- explore-codeRigor Improve implementation leaf skill for auditable candidate implementation in deep learning research repositories. Use when the researcher explicitly authorizes exploratory work on an isolated braSkillsMay 2026
- ubiquitous-languageSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- scaffold-exercisesSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
