Roblox Secret System Never Accepts Valid Secrets — Critical Blocking Issue

[KrimsonWoIf (ClassicDev)]

Description:
The secret management system in Roblox’s Creator Dashboard does not properly accept API keys as secrets for in-game use. Even when secrets are created with valid values and domain settings (* or valid domains), server scripts using HttpService:GetSecret() return nil or errors saying the secret can’t be found.

This prevents legitimate use of Roblox Cloud API keys required to access user inventories and other critical functionality. The domain validation is either too restrictive or misleading, causing secrets to never be sent to game servers.

Steps to Reproduce:

1. Create an API key in Creator Dashboard.
2. Add it as a secret with domain set to *.
3. Use HttpService:GetSecret("SecretName") in a server script.
4. Observe that the secret is not accessible (nil returned).
5. Attempt other domain values, still no success.

Expected Behavior:
Secrets should be accessible via HttpService:GetSecret() on Roblox game servers when domain is set to * or valid Roblox domains.

Actual Behavior:
Secrets are never accessible; domain validation blocks sending secrets; error messages mislead developers.

Impact:
Blocks usage of critical APIs that require API keys, forcing insecure or impractical workarounds and harming developer experience.

---

[bvetterdays (roman)]

This is not a bug. To use secrets in some TC sessions, you need to store them locally:

Secrets Store General Availability

And here you go! Roblox Studio lets you configure secrets locally. Go to File → Game Settings → Security, and when “Allow HTTP Request” is enabled, a new text box appears, allowing to enter locally-defined Secrets in JSON form. Example: {"google": ["cGFzc3dvcmQ=", "*.google.com"]} It’s on me to document it better, but I believe it’s so exciting that I can’t wait to share it! Other fixes and improvements are coming soon!

[KrimsonWoIf (ClassicDev)]

Obviously this feature is very badly made if its not a bug. Why do I need to go on the site and in studio. Roblox is a terrible platform

[Hooksmith]

Sorry for the inconvenience. If we allow Studio to pull down real production secrets, it would allow someone with access to your account to compromise these secrets by using the API to pull these down, so that’s a no-go because it goes completely against what Secret Store is meant to accomplish.

I’ll forward the feedback that maybe we should allow management of Studio/test credentials on Creator Hub or at least some easier way to manage local credentials.