API keys and permission scopes

Create keys in Settings → API Keys. A community can hold up to 25 keys, and a key name can contain up to 64 characters. The dashboard offers Read-only, Member management, Full access, and custom permission selections.

The full secret is displayed once. After the modal closes, the dashboard shows only safe metadata such as the key’s name, prefix, state, dates, and permission count.

Available scopesCopy link to Available scopes

Scope	Allows
members.read	List members and fetch a member profile.
members.experience.write	Add, remove, or set member experience through the supported operation.
members.quota.write	Add, remove, or set member quota points.
members.ranks.write	Set, promote, or demote a Roblox member rank. Pro required.
members.medals.write	Award or remove member medals.
members.qualifications.write	Award or remove member qualifications.
members.suspensions.write	List, create, restore, or cancel member suspensions.
ranks.read	List ranks or fetch one by Roblox role resource ID.
medals.read	List medals or fetch one by name.
qualifications.read	List qualifications or fetch one by name.
blacklists.read	List or fetch user and group blacklist entries.
blacklists.write	Create, edit, or remove blacklist entries.
warnings.read	List or fetch warning records.
warnings.write	Issue, edit, or delete warnings.
events.read	List events, types, and locations or fetch one event.
events.write	Create, announce, finish, or cancel events.

Use least privilegeCopy link to Use least privilege

Start with a read-only preset, test, then add one required write scope at a time. A scope only authorises the API surface; the community must also have the product feature and active subscription.

Use separate keys such as Production roster sync, Event service, and Staging tests. This makes audit activity attributable and lets you revoke one integration without interrupting the others.

Rotate a keyCopy link to Rotate a key

1. Prepare the secret manager for a new value.
2. Select Rotate on the intended key.
3. Copy the new one-time secret into the server-side store.
4. Deploy and test one safe read.
5. Confirm the old secret no longer works.

Rotation invalidates the previous secret immediately. If cache invalidation cannot be reached, it can remain accepted for about one minute. Treat the old value as compromised and remove it everywhere.

Disable versus deleteCopy link to Disable versus delete

Disable a key for a reversible pause. Delete it only when the integration is retired; deletion cannot be undone. The community API master switch disables all keys together.

A migrated legacy key is limited to the old /users and /v1 compatibility routes. Rotate it to obtain a current cl_live_ key before moving the integration to /v2.

For a step-by-step setup, see Create and manage API keys.