mcpField
R
roblox-oauth

roblox-oauth

github.com/tabooharmonySecurity138240 installsUpdated 2w ago
Repository

About roblox-oauth

An OAuth 2.0 reference skill for developers integrating with Roblox Open Cloud, covering app registration, PKCE authorization, token lifecycle, scopes, and error debugging. It distinguishes requirements for public and confidential clients and outlines secure handling practices.

Key features

  1. 01Authorization code and PKCE flow selection
  2. 02Authorization code and token exchange guidance
  3. 03Access token refresh and revocation
  4. 04Least-privilege scope selection
  5. 05Identity and token validation endpoints
  6. 06OAuth troubleshooting guidance

Use cases

  1. 01Configuring authorization for a Roblox Open Cloud app
  2. 02Implementing PKCE for a public client
  3. 03Managing token refresh, replacement, and revocation
  4. 04Investigating scope or OAuth token issues

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/tabooharmony/roblox-brain --skill roblox-oauth

After installing, type/roblox-oauthin Claude Code to confirm it loaded.

Bundled filesreferences/full.md

Details

From the project README

roblox-oauth

When to Load

Load this skill when the task centers on Roblox OAuth 2.0 delegated authorization for Open Cloud — app registration, authorization code flow with PKCE, token exchange/refresh/revocation, scope selection, or OAuth-specific error debugging. Skip it for API-key automation, in-experience scripting, or general Open Cloud endpoint work (use roblox-cloud instead).

Quick Reference

Flow Selection
  • Auth Code + PKCE — required for public clients (browser/mobile), recommended for all.
  • Confidential — backend holds client_secret; never expose in frontend code.
  • Public — no secret; PKCE mandatory.
PKCE Essentials
  • Generate code_verifier (43–128 char random) + code_challenge (SHA-256, base64url).
  • Send code_challenge + code_challenge_method=S256 in authorize; send code_verifier in token exchange.
  • One verifier per authorization attempt.
Authorization URL

GET https://apis.roblox.com/oauth/v1/authorize Params: client_id, redirect_uri, scope, response_type=code, code_challenge, code_challenge_method=S256, state, optional nonce.

Token Exchange

POST /oauth/v1/token — application/x-www-form-urlencoded Params: grant_type=authorization_code, code, client_id, code_verifier (public) or client_secret (confidential).

Token Lifecycle
  • Auth code — seconds, single-use; exchange immediately.
  • Access token — ~15 min; use as Bearer.
  • Refresh token — ~90 days; single-use per refresh. Replace stored token atomically after each refresh.
  • Revoke: POST /oauth/v1/token/revoke on disconnect.
Scope Selection
  • Minimum scopes matching actual endpoint needs.
  • openid → ID token; profile only if profile claims needed.
  • Medium/high/critical risk = least-privilege review signal.
  • Changing scopes requires reauthorization.
Validation Endpoints
  • GET /oauth/v1/userinfo — identity claims.
  • POST /oauth/v1/token/introspect — token activity (not resource auth).
  • POST /oauth/v1/token/resources — resource-level access.
Key Rules
  • Verify state before using returned code.
  • Refresh tokens: server-side only.
  • PKCE even for confidential clients.
  • Don't mix API keys and OAuth. Need more detail? Load references/full.md for the complete reference with code examples, API tables, and edge cases.

Comments

Markdown supported