If there is a tutorial on how to use this with discord bot, can you please ping?
The only thing you need really is the API Reference (which they give in the announcement)
yeah but im kinda new to discord.js and really dont know my way around. I already have the bot setup, and some codes running, if anyone can help, that’ll be great.
The api key system is broken.
I kept regening the key and changing my code for the key, it always returns invalid api key.
Websockets are secure by design, they’re web sockets and have the same security as a typical HTTPs request. The wss protocol is the https equivalent for WebSockets, ws being the http equivalent. A WebSocket connection is initialized through a typicalHTTPs request where the server does something called a “protocol upgrade” which basically means that the server and client are agreeing to “upgrade” to the WebSocket protocol (because, ofc, they’re not the same thing as HTTPs).
There is no difference in security between the two, iirc they use the same encryption schemes, and they both are very similar, after all, they work in browsers and are designed to closely mesh with HTTPs.
In fact, though I wouldn’t really necessarily agree with this, you could likely make an argument that WebSockets are technically actually more secure since you’re not establishing new connections all the time, which means doing more handshakes, and that’s technically more possibilities for MITM attacks. But, that’s pretty much the whole reason a “secure” version of the http (and ws) protocol exists in the first place (to stop MITM attacks).
It’s more likely that the reason that WebSockets are not being utilized here is simply a technical limitation on Roblox’s end. A lot of older web software doesn’t support WebSockets, because, well, WebSockets are relatively newer. If I had to guess, it would take some special engineering to introduce WebSockets onto the platform.
However, I do sort of wish that MessagingService relied on WebSockets to begin with because it’s a pretty battle tested technology and I would imagine it would make a lot of aspects of MessagingService more streamlined to implement, such as being able to subscribe with the API here too.
Roblox is probably considering or has considered WebSockets, and given that the actual API docs mention subscribing to messages as if it’s a feature of the API, it’s probably something they want to do:
The Messaging Service API is the Open Cloud equivalent to the Lua
MessagingService, which supports live servers to send and subscribe to customized message channels called topics.
On a completely unrelated note, I’ve recently seen some arguments being made for adding some sort of WebAssembly support (partially or in full) for similar reasons. (One of the prerequisites to being able to do WebAssembly stuff in Roblox performantly would be some sort of limited jumping through scopes for example, which is something still being discussed on the luau repository)
WebAssembly is inherently secure, and extremely performant (after all, it’s meant to run in your browser, and browsers are probably one of the most security-focused pieces of technology you use, and are using right now to read this 
). It would make it possible to somewhat utilize endless normally native languages on Roblox the same way they are on the web, and would introduce a huge number of possibilities.
Some cool consequences of this:
- Reading/writing the RBXM format in-game (Would be awesome for tools such as Rojo)
- Using other Rust and C programs
- Making custom luau VMs in Roblox (such as for a sandboxing tool, or making modified lua environments)
- JavaScript or TypeScript running at native speeds (such as with the WIP AssemblyScript project)
- Compression algorithms such as LZ4 (or the similar and potentially even more powerful zstd) and reading archive formats like zip files for storing lots of stuff compactly.
Having WebAssembly on Roblox (even transpiled or interpreted via luau such as with the Wasynth project, but especially with native or near native speeds) might excel Roblox forward quite a lot in its power as a game engine.
Really, I strongly believe browser tech is something Roblox can utilize and benefit from immensely in a lot of cases, and at the very least, it’s a great place for them to take inspiration from in some regard considering many applications are now becoming browser based (For example, Discord is based on Chromium, it uses a “headless” Chromium called Electron)
Open Cloud is quite confusing for me. Does it simply let you use Roblox endpoints in other languages such as Javascript or Python?
Even from other posts here, I still don’t understand how to send a JSON payload. It doesn’t seem to work as expected.
On Roblox, it would look like this, as expected:
MessagingService:PublishAsync("MyTopic", {hello = 32})
MessagingService:SubscribeAsync("MyTopic", function(msg)
print("MESSAGE", HttpService:JSONEncode(msg)
end)
--> MESSAGE {"Sent": <timestamp>, "Data": {"hello": 32}}
But when I do the same thing from the Open Cloud API, it doesn’t work. If I leave the message payload as a JSON object, I get a 400 error. If I encode it as a string, it works, but the Lua code subscribing to the message does not decode it to a Lua table as expected.
For instance, I am sending the following payload via Postman:
{
"message": "{\"hello\":32}"
}
And the response I get in my Lua topic subscription is:
--> MESSAGE {"Sent": <timestamp>, "Data": "{\"hello\": 32}"}
You see how the Data payload is wrapped in a string? It didn’t get parsed as expected. Maybe I’m doing something wrong? But I suspect this is a bug.
2 Likes
No.
What makes Open Cloud so amazing is that it will eventually allow you to directly interact with the Roblox API without needing a ROBLOSECURITY Cookie. It’ll all be done through API Keys.
Open Cloud also supports an API key-based access to help automate your internal workflows, and the ultimate goal is to improve your efficiency creating content on Roblox through an application ecosystem of tools and services.
Their goal is to eventually support all Web APIS with Open Cloud
What about for things such as currency api, that need to know the user?
Well, One of the two ways to create an API Key is to create it under a specific account, so I’m assuming that anyone using the API Key created under that specific account (and if the IP that’s being used is whitelisted) can interact with APIs that need to know the user.
1 Like
What was wrong with just using .ROBLOSECURITY cookie? (and, a little off-topic, but why isn’t it called .ROBLOXSECURITY instead?)
Edit: Is it because RobloSecurity expires?
Unreliable for many reasons. One of the major ones being this.
You can also whitelist only certain IP Addresses that are able to use the API Key. This is useful because if someone were to get a hold of your API Key, they wouldn’t be able to use it if they aren’t on the correct IP Address. 
You don’t have that advantage when using cookies.
No clue on that one.
1 Like
Isn’t that the same exact functionality? If someone tries the .RobloSecurity on a different IP than initially logged in with, it doesn’t let them? (Well besides that you can’t use it again.)
My guess is that maybe cookies have (or had) a character limit.
Oh so does this allow for things to happen externally when something is published with messaging service?
Well, when someone tries to login from a different IP Address with the cookie, it invalidates itself, making it useless.
With API Keys, that won’t happen. The API Keys will only work on the specified IP Addresses.
Hello everyone! I saw some of you find the tutorial/API docs hard to read so due to this I have made a tutorial based in node.js if anyone want to check it out. I have broken down the API in bits so it should be easy to understand.
1 Like
Really beautiful and detailed tutorial!
+kudos to you for taking your time with this, your tutorial will for sure help many people 
1 Like
Sorry for bumping this thread, but had some issues regarding MessagingService. The SubscribeAsync function doesn’t respond at all. I tried debugging but nothing works. Can anybody tell how should I actually arrange my code (in roblox studio)?
I am not getting stuff to work, I get proper response and everything, but roblox does not seem to listen to requests at all.
Code in roblox:
messagingService:SubscribeAsync("among", function(msg)
print('test')
print(msg.Data)
end)
How i send requests:
const fetch = require("node-fetch")
async function s() {
const res = await fetch(url, {
method: "POST",
headers: headers,
body: {message: 'test'}
})
console.log(res)
}
s()
the URL looks like this: https://apis.roblox.com/messaging-service/v1/universes/4139112970/topics/among
(got it to work)
I am receiving code 500 (Internal Server Error) when trying to publish a message now. Is there a ongoing issue at the moment?
2 Likes