[Public Beta] Building Your Applications with OAuth 2.0

Updates Announcements
#187

Not anymore, just need to be ID verified iirc

#188

are there any plans to improve managing group-owned OAuth2 applications?
so many annoyances are currently faced

  1. the group owner must be ID verified (understandable)
  2. the group owner must create the application themselves
  3. group members with sufficient permissions cannot create or even manage (!) OAuth2 applications
  4. when group ownership is transferred, the OAuth2 application is no longer accessible, even when transferring back

i hope these issues can be addressed

#189

Hey there, 1-3 are known limitations, but also this doesn’t seem super impactful since changes to OAuth apps should be rare (image/title/description/scope list edits should not be too common past development stage), and ultimately the group owner is responsible for the behavior of the app so it makes sense to impose those restrictions on the group owner.

I agree ideally 3 and maybe also 2 should be adjusted in the future at the least but given above it is not very high priority work. It’d be good to understand how much of a pain point this is for you. This feature requires engineering work so it is not free and would slow down other projects in progress.

For 4, that seems like a bug, can you please file a bug report with all necessary details? That is not the intended behavior of the feature and should be fixed.

#190

thanks for your response :pray:
while its quite understandable that the group owner should be responsible for the app and such, most of them just cannot get to understand how to, and needing to guide them for the most basic tasks such as adding redirect URIs (+ needing to wait for a response) is quite frustrating

if a group owner trusts a person to develop their application, its no different from trusting them to manage it, hope this will be considered

creating an app is understandable, but managing it should be made possible to authorized roles/users

1 Like
#191

Hey, how do I request scope extension of scope “email” for OAuth2 use? It is really important scope for us to have.

Because current user data scopes are very limited:

image
image700×116 19.7 KB

And we need an email to succesfully create a user account on our service.

#192

It’s not available to third-party applications at this time due to security/policy reasons.

1 Like
#193

Alright I get it, would it be possible to consider adding “group:join” scope so the app could make users join to a group once authenticated? I think this could help many people with group approvals when it comes to more private groups, e.g. against bots or alt accounts.

Additionally a “avatar” claim so we can get user’s 30day avatar picture alongside the 30day headshot under “picture” claim.

#194

Getting user avatar => being worked on as a separate API to call. It won’t be a new claim. We only support picture claim for OpenID Connect backward compatibility.

Group join scope => please file a feature request with us for visibility.

1 Like
#196

It’s not the age verification that keeps away bad actors, it’s the sending of your ID to Roblox that keeps away bad actors. There wouldn’t be many people willing to do illegal things with their OAuth 2 linked websites if Roblox has there legal name and ID.

1 Like
#197

Please review this post:

#198