Treat an exposed Roblox API key as a compromised credential. Roblox describes an API-key string as equivalent to an application password. A user-owned key can generally access resources available to its owner, including qualifying group-owned experiences, although some scopes can be restricted to particular experiences.
1. Contain and replace the key
Review the exposed key's owner, permissions, operations, resource restrictions, consumers, and status. Disable or delete it promptly. If continuity requires installing a replacement first, keep the overlap brief and disable the exposed key immediately after the replacement is available.
Create a separate replacement for the affected application. Grant only the required operations and restrict supported scopes to the required experiences. Roblox specifically says not to apply IP-address restrictions when a key is used from Roblox places, because it must work from Roblox servers.
For group automation, use a dedicated account limited to the target group and give it only the minimum required group role. This avoids exposing unrelated resources accessible through a personal account.
2. Update Secrets Store
For a key consumed inside an experience, open Creator Dashboard, select the experience, and choose Secrets → Create Secret, or edit the existing entry. Supply the secret name, replacement value, and applicable domain.
Keep the existing name when deployed scripts already reference it. Use a specific permitted domain when possible; Secrets Store also supports limited wildcard forms such as .example.com, while unrestricted is not recommended.
Do not place the replacement key in Luau source or a Data Store. Roblox recommends Secrets Store for sensitive values used by an experience. Server scripts retrieve these values through HttpService:GetSecret(). The resulting Secret value cannot be printed as plaintext or manipulated as an ordinary string, and it can be used in request URLs or headers but not request bodies. Outbound requests also require Allow HTTP Requests to be enabled in the experience's security settings.
3. Restart affected servers
Roblox servers retrieve associated secrets when they start. Creating, updating, or deleting a secret does not push the change to servers that are already running, so those servers must restart before the new value takes effect.
Use Creator Dashboard's server controls:
- Open Creations and select the experience.
- Go to Configure → Server Management.
- Select every affected place.
- Choose Restart Servers and confirm.
4. Handle local testing separately
An experience's Secrets Store values are available to live servers and collaborative testing environments, but not ordinary local playtests. Configure a separate local secret in Studio under File → Experience Settings → Security → Secrets. Use a non-production key with minimal permissions for local testing.
5. Verify the rotation
After restarting, test the smallest non-destructive operation needed to confirm that new servers can retrieve the replacement and perform the required API calls. Then confirm that the exposed key fails after it has been disabled or deleted.
Roblox documents POST https://apis.roblox.com/api-keys/v1/introspect for inspecting an API key. Its response can include the authorized user, scopes, operations, resource identifiers, enabled state, expiration state, and expiration time. Use it only through tooling that will not expose the key through history or logs.
Checklist
- ［ ］ Review the exposed key's owner, permissions, resources, and consumers.
- ［ ］ Create a separate least-privilege replacement.
- ［ ］ Avoid IP restrictions when Roblox places use the key.
- ［ ］ Update the Secrets Store value and domain restriction.
- ［ ］ Disable or delete the exposed key.
- ［ ］ Restart every affected place, including current-version servers.
- ［ ］ Configure a separate minimal key for local tests.
- ［ ］ Verify the replacement and confirm that the exposed key fails.