Skip to main content
Open Account → API Keys.

Create a key

Choose the intended server and scope. Store the returned secret on your backend, then make a read-only request against v2. Keep the secret API key separate from the PID, a public identifier used in verification flows.

Replace or revoke a key

Update every application using a replaced key. A revoked or inactive key should fail authentication; do not retry it as a temporary quota error.

IP restrictions

Where advanced settings are available, IP mode can be off, allowlist, or denylist with IPv4 or IPv6 CIDR rules.
Never place a key in frontend JavaScript, a Roblox client script, a public repository, or a verification link.