Get started
Access and limits
Keyless where the data is public, a key where it is yours. A name in your User-Agent helps us help you.
The keyless tier
The index, the live numbers, the games and the platform limits are public because every number on them is public on Roblox already. There is no token to send, nothing there returns 401, 403 or 429, and there is no per-caller limit: the CDN carries the load and each endpoint has a window it holds an answer for.
| Endpoint | Held for | Why |
|---|---|---|
GET /v1 | 1 hour | The index changes only with a release. |
GET /v1/live | 5 seconds | The counts Roblox refreshes most often. |
GET /v1/games | 5 minutes | The list behind the studio's own pages. |
GET /v1/games/{universeId} | 5 minutes | Read out of the same list. |
GET /v1/limits | 1 hour | A static list that changes only when the limits page does. |
GET /v1/limits/{id} | 1 hour | Read out of the same list. |
Every keyed endpoint | not cached | The answer is yours alone; cache-control: no-store. |
The keyed tier
Everything under your account and every product page marked with a scope needs Authorization: Bearer <key>. A key comes from the keys page, is scoped per product, spends against a per-minute bucket and a monthly quota (rate limits), and every writing endpoint takes an Idempotency-Key. Keyed answers are never cached and carry no CORS headers: they are for your server, not a browser.
Open CORS on the keyless tier
Every keyless answer carries access-control-allow-origin: *, so a browser page on any domain can call it directly. Preflights are answered for GET and OPTIONS with content-type allowed and a one day max-age.
access-control-allow-origin: *
cache-control: public, s-maxage=5, stale-while-revalidate=10
content-type: application/json
x-request-id: req_01J9X4Q2M7V8K3B5N6P7R8S9T0Say who you are
A User-Agent naming your app or site, with a way to reach you, is the only thing we ask on the keyless tier. If a client ever misbehaves it lets us write to you instead of blocking a range.
User-Agent: cola-tracker/1.0 (hello@example.com)