[OAuth2] Add a universe.read scope to list a user’s experiences

Feature Requests Website Features
1

Overview

I’m building a third-party creation tool that integrates with Roblox’s Open Cloud APIs. A critical part of onboarding is letting a user choose which of their experiences they want to connect to the tool.

Currently, this is impossible using OAuth2, because there is no scope or endpoint that allows an OAuth application to list the authenticated user’s experiences (universes).

Problem

OAuth2 on Roblox is currently limited to identity scopes (openid, profile) and a few specific write scopes like:

universe-places:write

However, there is no read scope that allows:

Listing all universes (experiences) owned by the user

Getting universe metadata

Enumerating places inside a universe

Fetching the user’s “Creations → Experiences” list

Multiple developers — including Roblox staff — have confirmed that:

“There is no way to list experiences or places owned by the user through OAuth.”

This forces developers to require API Keys, even for simple read-only actions.

Why This Is a Problem

1. Poor User Experience

For a lot of tools (plugins, dashboards, automation tools), the user must:

Leave the tool

Go to Creator Dashboard

Manually create an API Key

Manually grant universe permissions

Paste the key into the app

This is intimidating for non-technical creators.

OAuth2 was meant to fix this — but without the ability to list experiences, onboarding remains complicated.

2. Standard Behavior on Every Major Platform

Platforms like:

Discord

GitHub

Google Cloud

Twitch

AWS Cognito

all allow OAuth applications to list user-owned resources.

Roblox is the only major platform where this is blocked.

3. Safe, Low-Risk, and Already Available via API Keys

All of this data is already available through API Keys using:

GET /v1/universes
GET /v1/universes/{universeId}
GET /v1/universes/{universeId}/places

There is no additional privacy or security exposure by allowing OAuth access to the same data.

Requested Feature

Please add a simple, read-only OAuth2 scope such as:

universe.read

(or experiences.read)

This scope would allow:

Listing universes the user owns

Reading universe metadata

Listing places inside those universes

Example:

GET https://apis.roblox.com/cloud/v2/users/@me/universes
Authorization: Bearer <oauth_token>

Use Cases

This scope would unlock a huge number of third-party tools, including:

Plugin onboarding flows (“Select Your Experience”)

Live dashboards

DevOps/build pipelines

Content deployment tools

Analytics dashboards

Command systems (Discord → Roblox)

Backend integrations

CI/CD for larger projects

Right now, all of these require manual API Key creation.

Benefits to Roblox

Encourages developers to adopt OAuth2 instead of API Keys

Reduces support load for Roblox (fewer API Key issues)

Improves third-party developer ecosystem

Enables safer, more polished tools

Makes Roblox more consistent with industry standards

Conclusion

This is a small but extremely impactful change.
Adding a universe.read OAuth scope would dramatically improve the third-party development ecosystem and reduce reliance on API Keys for basic read-only operations.

Thank you for considering this!
I’d be happy to provide examples, test code, or feedback during rollout.

Note: Sorry if this is in the wrong category, there wasn’t a dedicated category for cloud feature requests inside Feature Requests

3 Likes
2

I agree with this! As a matter of fact, there doesn’t seem to be a GET /v2/universes endpoint at the moment - this should definitely be added! And the GET /v2/universes/{universeId}/places requires the universe.place:read scope, which is available for neither API keys nor OAuth2 authorization - this should be changed as well!

However not all is doom and gloom! The GET /v2/universes/{universeId} works with OAuth2 authorization, without any additional scope - I tried it using only the openid profile and it worked!

Further, the authorising user selects the experiences they’d like to give the application access to. This list of experiences can be fetched using POST v1/token/resources under the OAuth2 OpenID spec, check out the docs: https://create.roblox.com/docs/cloud/auth/oauth2-reference#post-v1tokenresources. This is pretty helpful as not only does it give a list of universe IDs, but it also only provides the ones relevant to your application!

That being said, I definitely agree that the listing universes and places endpoints should be added to both API keys and OAuth2 authorizations! I hope my response is helpful for your use case!

3

Thank you for supporting this feature-request idea! I really appreciate it — and your reply adds some very useful context. I do want to clarify one point regarding the v1/token/resources endpoint you mentioned:

POST v1/token/resources

There are two important limitations that make this endpoint unsuitable for fetching a full list of experiences owned by the user:

  1. It only supports POST, not GET
    As shown in the documentation you linked, v1/token/resources is strictly a POST request meant for retrieving resources associated with the user for the specific scopes granted to the application. It isn’t a general “list my universes” endpoint.

Disregard this first comment as you changed it from GET to POST

  1. It does NOT return all experiences the user owns
    It only returns the specific universes/experiences the user has explicitly granted this app permission to access.
    This makes it useful after permissions are granted, but not workable for showing the user a complete list of their experiences during onboarding.

For my use case, it’s essential to fetch the full list of experiences the user owns, so a dedicated OAuth2 scope such as universe.read would solve this cleanly.

Thanks again for supporting this feature — hopefully Roblox considers adding it!

1 Like