Secrets and HTTP

How the game handles API keys, webhook addresses and the web requests it makes with them: secrets left where clients can read them or written into scripts instead of the experience's secrets store, requests whose address or headers a client gets to choose, and player text passed on to outside services with nothing to stop it being spammed.

Back to categories
How to rank players in your group from a game safelycritical

Open Cloud can assign group roles from your game. How to stop players asking for staff roles, and how to limit the API key.

Why the client shouldn't choose your HttpService requestscritical

A remote that builds a request address from client input lets players call your API with the game's key. How to map client choices to fixed addresses.

Why API keys and webhooks don't belong in client scriptscritical

Any ModuleScript in ReplicatedStorage can be read by exploiters, even if only the server requires it. How to find leaked keys and webhooks and move them to the secrets store.

How to check HttpService responses before trusting themcritical

RequestAsync doesn't raise an error for 4xx and 5xx replies. How to check Success, decode safely and treat anything but a clear yes as a no.

Why server errors shouldn't be sent to playerswarning

Raw errors and web replies tell exploiters how your server works. How to log the details and send players a short message instead.

How to use the Roblox secrets store for API keyswarning

Keys typed into server scripts travel with every copy of the place. How to move them into the secrets store and read them with HttpService:GetSecret.

How to stop Discord webhook spam from your Roblox gamewarning

Bug reports and feedback sent to a webhook with no cooldown or mention limits can be flooded or ping everyone. How to add a cooldown, a length cap and allowed_mentions.

How to send player text safely in HttpService requestswarning

Joining player text into a URL or JSON string lets it add parameters or fields. How to use UrlEncode and JSONEncode instead.

Each guide covers one problem. Fixing every one of them makes a game harder to exploit, but it doesn't make it secure on its own: review your own game logic too.