Authentication and keys
How keys work, who can create them, and how to keep them safe.
Send the key in the Authorization header of every request:
Authorization: Bearer rwk_…Cookies are never used: being signed in to the dashboard gives a program no access, and the API sends no CORS headers, so it cannot be called from a web page. Use it from servers, scripts and bots.
A key acts as you, with less
A key belongs to the person who created it and acts as that person, but only:
- in the experiences chosen when it was created, and
- with the permissions chosen when it was created.
On every request RoWarden looks up what your role can do right now. A key can never do more than you can: if your role loses a permission, is lowered, expires, or you are removed from the staff, or the owner's plan no longer includes the API, the key stops working for that the very next request. Nothing has to be revoked. If you are the owner and transfer the experience, your keys follow your new, lower role.
Some things can never be done with a key: managing keys, roles, staff access, settings, Discord, billing or any credentials.
Who can create keys
Anyone with the Create and use API keys permission in an experience, and a plan that includes the API (every plan does). You cannot give a key a permission you do not have in every experience you choose. If an experience asks for 2FA, you enter a code when you create the key.
The owner and anyone with Manage API credentials sees every key that can reach their experience, under Open Cloud & In-game, and can remove it there. They see the key's name, who made it, its permissions and when it was last used, never the secret.
Expiry, new secrets and revoking
Keys expire after 30, 90 or 365 days, and you are told a week before. New secret replaces the secret and keeps everything else; the old secret stops working at once. Revoke ends a key for good.
Keep keys secret
- Store keys in environment variables or a secrets manager, never in code or a repository.
- Give each program its own key with only the permissions it needs.
- Never put a key in a Roblox game. Servers and clients are not safe places for secrets. In-game features use the generated script and its in-game key; see the in-game script.
- If a key may have leaked, revoke it. RoWarden stores only a fingerprint, so we cannot show you a key again.