Ccr1tt
May 21, 2026, 8:47pm
1
Hello i’ve seen other discord bots & games that have a feature that lets them pay out R$ from their group without needing assistance.
I’ve been trying to re-create this, Using GitHub - Cramber25/roblox2fapayout: a simple way to automate roblox group payouts when the holder account has two-step verification enabled. · GitHub
I saw it
(Focuses vision upon digital messages with eyeballs)
avodey
May 22, 2026, 9:01pm
5
You can use the Open Cloud Groups API to do this! You’d need a login cookie to use this endpoint. Hopefully 2FA isn’t required all the time to use this.
1 Like
To do this, you need to use the Payout API using python. This should originally be used by the repo you sent. It requires cookies AND 2fa, so without it you cant do this.
If for some reason it returns a 503, then it means this feature is unavailable.
Good luck.
Ccr1tt
May 23, 2026, 12:12am
7
Roblox’s reccent security update now prevents me from using that method
opened 10:10AM - 29 Apr 26 UTC
Hi,
I’m trying to implement your script in my own server-side application, but … I’m running into an issue at the final step of the challenge flow. Here’s what I’ve done so far:
`POST https://groups.roblox.com/v1/groups/{groupId}/payouts`
Request body follows the docs:
```json
{
"PayoutType": 1,
"Recipients": [
{
"recipientId": 123456789,
"recipientType": 0,
"amount": 10
}
],
"IdempotencyKey": "random-uuid-here"
}
```
The initial payout request returns a `chef` challenge, which I handle by calling:
`POST https://apis.roblox.com/challenge/v1/continue`
with:
```json
{
"challengeId": "outer-challenge-id",
"challengeType": "chef",
"challengeMetadata": "{\"...chef metadata from rblx-challenge-metadata...\"}"
}
```
That succeeds and returns a `twostepverification` challenge.
Then I verify the authenticator code with:
`POST https://twostepverification.roblox.com/v1/users/{userId}/challenges/authenticator/verify`
Payload:
```json
{
"actionType": "Generic",
"challengeId": "nested-2fa-challenge-id",
"code": "123456"
}
```
This succeeds and returns a `verificationToken`.
Then I continue the 2FA challenge with:
`POST https://apis.roblox.com/challenge/v1/continue`
Payload:
```json
{
"challengeId": "outer-challenge-id",
"challengeType": "twostepverification",
"challengeMetadata": "{\"verificationToken\":\"verification-token-here\",\"rememberDevice\":false,\"challengeId\":\"nested-2fa-challenge-id\"}"
}
```
However, this request returns HTTP 200 but the response body is:
```json
{
"challengeId": "outer-challenge-id",
"challengeType": "blocksession",
"challengeMetadata": "{\"requestPath\":\"/v1/groups/{groupId}/payouts\",\"requestMethod\":\"POST\",\"headerTranslationKey\":\"\",\"bodyTranslationKey\":\"Denied.AutomatedTampering.Body\",\"actionTranslationKey\":\"\",\"sharedParameters\":{\"shouldAnalyze\":false,\"genericChallengeId\":\"outer-challenge-id\",\"useContinueMode\":false,\"renderNativeChallenge\":false,\"delayParameters\":null}}"
}
```
So the flow reaches:
1. CSRF token acquired
2. Initial payout receives `chef`
3. `chef` continue succeeds
4. TOTP verify succeeds and returns `verificationToken`
5. `twostepverification` continue returns `blocksession`
Im trying to understand whether I’m missing a required field/header in the 2FA continue step, or whether group payouts through this challenge flow require browser-only/session-integrity context that cannot be completed from a server-side HTTP client. I tried to cold down for half an hour before make other request but is not working
- Is the `challengeMetadata` for `twostepverification` continue supposed to include only `verificationToken`, `rememberDevice`, and nested `challengeId`, or should it include additional fields from the returned challenge metadata?
- Does the payout endpoint require a browser session / additional challenge context beyond `.ROBLOSECURITY`, CSRF token, and the challenge headers?
- Is `Denied.AutomatedTampering.Body` expected when calling this flow from a non-browser HTTP client, even if the TOTP verification itself succeeds?
Have a nice days, thanks in advance for any insights you can share!
1 Like
system
July 26, 2026, 9:19pm
11
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.