How to use the Roblox Login API (V2) with CAPTCHA

Help and Feedback Platform Usage Support
,
#1

I am making a ranking bot using a service that supports my application but does not set my app on one single server. Roblox deletes cookies that have a significant location change, so I would need to get a cookie using a VPN located close to the server where my project is hosted. This can be very frustrating, doing it once or twice every day, so I would like to log in with the https://auth.roblox.com/v2/login API. This project is in node.js.

There are a few issues with this. When I send a request with the Axios library with the correct username, password, and token, it returns forbidden. Is my captcha token the one I get from the data-hcaptcha-response attribute? What is my captchaProvider parameter? Here is what I have so far.

axios.post('https://auth.roblox.com/v2/login', {
  captchaProvider: "PROVIDER_HCaptcha",
  ctype: 'Username',
  cvalue: "Username",
  password: "Password",
  captchaToken: "CaptchaTokenFromHCaptcha"
}, { headers: {
  'x-csrf-token': 'MyToken'
}})
  .then(data => console.log('Logged in.'))
  .catch(a => {
    console.log(a.request.res.statusCode);
  });

I am not really familiar with Roblox ToS, so please tell me if this idea conflicts. Thank you for your help in advance!

2 Likes
#2

This is just wrong on so many levels
Roblox doesn’t use HCaptcha, they use Funcaptcha

You will get details of the captcha id and metadata (blob data) from headers which you need to solve in order to get a valid token. Then you need to send a request back to the api with the token and captcha id in headers

3 Likes
#3

Oop… Do I request one login attempt, then take the headers, render a captcha on my end, and then make another request? Or do I get the headers from another endpoint? Also, how do I render a funcaptcha on my server/html page to be sent back to roblox?

2 Likes
#4

You make a request, get the data from the headers, and request again with the correct headers

As for rendering the captcha it’s difficult. if I remember correctly, there is a library called funcaptcha which will render the link for your challenge based on the blob data and public key, then you have to put the captcha in an iframe, track results, and on completion it will return a valid token

3 Likes
#5

I can not find the funcaptcha ID anywhere in the response’s headers… This article states that what I am doing may not be possible without an oauth key. Is this true?

2 Likes
#6

Wdym funcaptcha id? What field are you looking for

1 Like
#7

I am looking for the Captcha ID. Is there another endpoint that gives this?

1 Like
#8

The captcha id is returned in the metadata after you decode the base64

1 Like
#9

I’m so sorry for asking so many questions, but where is metadata located? There seems to be no base64 in a.request.res.headers…

1 Like
#10

Make the initial login request and send the headers that print

2 Likes
#11

Here are the headers… I removed things that may or may not be secrets or identifiers.

access-control-expose-headers: "X-CSRF-TOKEN"
cache-control: "no-cache"
connection: "close"
content-type: "application/json; charset=utf-8"
date: "Thu, 31 Aug 2023 20:05:50 GMT"
nel: "{\"report_to\":\"network-errors\",\"max_age\":604800,\"success_fraction\":0.001,\"failure_fraction\":1}"
report-to: "{\"group\":\"network-errors\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://ncs.roblox.com/upload\"}]}"
roblox-machine-id: "Removed"
server: "Kestrel"
strict-transport-security: "max-age=3600"
transfer-encoding: "chunked"
x-csrf-token: "Removed"
x-frame-options: "SAMEORIGIN"
x-roblox-edge: "Removed"
x-roblox-region: "us-central"
1 Like
#12

These aren’t headers you should be receiving, can you send the status message and status code of the request as well?

1 Like
#13

I am not sending any headers, but the response code is 403, and the response message is Forbidden. Is there anything wrong with the request?

1 Like
#14

Yea your request is not formatted correctly so roblox rejects it with a 403 (as they don’t really want people automating it)

Send your request format and I’ll see what’s wrong with it

2 Likes
#15

If I am trying to get a captcha, I am not sure if I should be using .get or .post… Here is the code that I am getting the headers from.

app.get('/api/get-captcha', (req, res) => {
  axios.post('https://auth.roblox.com/v2/login', {})
    .then(() => console.log('Error.'))
    .catch(a => {
      console.log(a.request.res);
      res.json(a.request.res.headers);
    });
})
2 Likes
#16

IMG_3520
IMG_35201170Ă—799 335 KB

You have to include certain data for the request
Not all fields are needed, it’s mostly experimenting

1 Like
#17

If I only want to get the captcha though, what data should I include?

2 Likes
#18

To get the data you have to make the request seem like an actual request

1 Like
#19

Do I include fake captcha data or none at all…

1 Like
#20

None you can leave the fields empty

1 Like