Token Validation Failed

[Gonistical (Deviant)]

I am messing with roblox’s apis but theres one thing I cant do:

import requests

web = 'https://chat.roblox.com/v2/send-message'
info = {
    'conversationId': 0,
    'message': "test message"
}
cookie = '_|WARNING:-DO-NOT-SHARE-THIS.--Sharing-this-will-allow-someone-to-log-in-as-you-and-to-steal-your-ROBUX-and-items.|_theCookie'

result = requests.post(url=web,data=info,headers={
    'Cookie': f'.ROBLOSECURITY={cookie}'
})

print(result.text)

I am getting a Token Validation Failed error for some reason
(I removed the conversationId and token on purpose here)

---

Any help is appreciated

[Tetraline]

you know you can’t do this in roblox? not only its breaking the rules but also didn’t include all other important headers that are listed when you do network recording. but just don’t do this at all tho

[Gonistical (Deviant)]

this is all for testing purposes, because i need to know how to use the apis correctly

[Gonistical (Deviant)]

still waiting for some help

[xmthl (Matthew)]

I think you need to provide a x-csrf-token header along with the cookie. I usually find them with my cookie data in the developer console (using Chrome). Or attached to a request payload (again, on Chrome you can view the network tab to see outgoing and incoming HTTP requests).

Keep in mind though that this token isn’t long lasting and expires quite frequently so you’d need to find a way to get the new token if this program you’re making is long lasting.

How to get your X-Csrf-Token

Here is a basic tutorial how you can get your X-Csrf.Token. 1. Go on Roblox 2. Right Click and click “Inspect element” and go on the “Network” tab or press ctrl + shift + I 3. Reload the Page (F5) 4. Filter or find “get-profiles” and click on it (any) 5. Something should pop-up and scroll it down at the bottom should be your X-Csrf-Token. [X-Csrf-Token]

Let me know where you get with it.

[hya123456h (KingBob)]

How cookies are verified has changed as well so it should be fine if this is being run on your local computer and your not using a vpn

[Gonistical (Deviant)]

Thank you! I put the c-srf-token in the headers and it worked!

[xmthl (Matthew)]

I’m glad it’s all working well.

What I would say with this is watch how you use this, depending on what it is could go against Roblox’s TOS. The topic I shared raises some valid concerns.

With great power comes great responsibility.

[Gonistical (Deviant)]

Yeah I know, Im just practicing on my alts, since im not that good with roblox apis