I have recently noticed that there is an increase of 403 errors on most of Roblox’s API’s.
I was getting game information using games.roblox.com using the universe ID just to get flashed by a nice Captcha response “Challenge is required to authorize the request”
Other API’s like sending a friend request are also affected by this.
Its stupid to have a captcha when I’m simply GETTING GAME information. This doesn’t even affect Roblox at all in terms of BOTS. I understand stuff like web scraping but this is simply just me pressing on a game on the front page and getting prompted a captcha to even SEE it.
Please fix this issue and remove captchas from useless stuff that doesn’t even affect you.
I’ve seen badge checking requests from the client itself being blocked by this, so I think something has gone haywire. Maybe it’d be worth making a bug report about this issue?
You should not use the classic Roblox endpoint. Instead, use the new Cloud API endpoint, which does not require CAPTCHA. There is no point in trying to bypass the system, in a near future all endpoints will follow this model, just adapt your code to what roblox gives at creators.
Tbf that is likely a bug then. But the captchas on apis i have encountered were either automatically solved in the background, or had some kind of visual on screen indicator that they think you are a bot.
There you go. Bad Cloudflare configuration probably sends everything thru their bot-fight system and whatever else they can throw at a GET or POST.
Make your own proxy with Cloudflare Workers. It’s free, fast and reliable.
I am so sick of this captcha garbage. APIs should be using rate limits, not a captcha. But it could be so much worse. They could force you to scan your ID each time. And with the way things are going, that may soon become an unfortunate reality.
Edit:
Of course they already made it so much worse:
They are, they are forcing you to scan your id. If your account is detected as a bot, which happens after multiple API captchas and other detections I assume. But if that happens they will lock your account for being a bot and force you to do either a face scan or ID scan.
I personally had one account I used for my project get locked like this.
Uh, some users of my userscript are still reporting errors when the script sends requests to the Roblox APIs. Most API endpoints are responding with { code: 0, message: “Challenge is required to authorize the request” }.
Can you file a new bug report with more specific information? Like specific routes, and whether you’re calling it from in-experience or from external tooling, and at what rate you are calling them?
I have a question specifically related to the gamejoin endpoint.
Is that endpoint in specific meant to have captchas?
If so why is that? as it is heavily used in my extension project since it is the only way to get server related information, like datacenter id which is used to figure out the location of a server.
