As a Web developer utilizing the OAuth 2.0 API, it is currently extremely difficult to convince regular users that integrating their accounts with our external web platforms is safe
The Problem:
Right now, the Roblox community is heavily plagued by phishing scams, cookie loggers, and malicious third party extensions. Because of this, users are rightfully incredibly paranoid when a website prompts them to log in using Roblox.
Even though OAuth 2.0 applications go through a manual review process by Roblox staff and have to get approved, there is no public facing way for a user to verify this approval.
When a user sees an OAuth prompt, they only have the developer’s word that the application is safe. This lack of transparency causes massive friction, distrust, and prevents legitimate developer tools and platforms from scaling.
Proposed Solution
Roblox should implement a public OAuth 2.0 Application Checker / Verification Tool or integrated directly into the Creator Marketplace/Documentation).
Key Features of the Tool:
- Search by Client ID or App Name: Users can paste a Client ID to instantly verify if the application is officially approved, pending review, or unverified/banned.
- Scope Transparency: The tool should clearly list exactly which scopes (e.g.,
profile,openid) the application is permitted to use, explaining in plain language what data the developer can and cannot access. - Developer Verification: Display the Roblox Username/Group that owns the OAuth application so users know exactly who created it.
Why this benefits the Roblox Ecosystem
- Drastically Reduces Scams: Malicious sites using fake phishing screens will be exposed because users won’t be able to find their “Client ID” in the official verification tool.
- Builds Trust: It encourages developers to use Roblox’s official OAuth 2.0 API rather than custom workarounds, knowing that Roblox provides the tools to prove their platform is secure.
- Peace of Mind for Players: Parents and younger players can easily double-check external fansites, trading platforms, and tools before connecting their accounts.
An approved app shouldn’t just be a hidden green badge in the Creator Dashboard for the developer; it should be a badge of trust that the entire community can publicly verify.