API key vault
Store Open Cloud keys once and attach them to experiences.
Open Cloud keys live in an account-level API Key Vault and are attached to experiences per purpose: experience, datastores or group. Choose one key for everything or separate keys on the API & In-game page; a purpose without its own key uses the experience key.
RoWarden asks Roblox which scopes each key has (the API key introspection endpoint) and shows, per experience, exactly what works: bans, messaging, analytics, datastores and group ranks. It warns when a permission is missing.
Keys are encrypted with AES-256-GCM, with the encryption key kept outside the database. Only a key's owner sees it and can attach it. Staff with Manage API credentials can add their own keys or detach keys, but never see or reuse the owner's other keys.
What to enable on a key
- Experience key: user restrictions (read and write), messaging service (publish), analytics (read).
- Datastores key: the data store permissions you need, plus delete for erasure requests.
- Group key:
group:readandgroup:write, on an account that outranks the ranks you map.