# Caching and CORS

The keyless tier is held by the CDN for a window per endpoint; a keyed answer is yours alone and never cached.

## Windows

Each keyless endpoint has a window the CDN holds its answer for, and a stale copy is served for twice that while a fresh one is fetched, so a slow read of Roblox never reaches you as a slow answer.

| Endpoint | Held for | Why |
| --- | --- | --- |
| GET /v1 | 1 hour | The index changes only with a release. |
| GET /v1/live | 5 seconds | The counts Roblox refreshes most often. |
| GET /v1/games | 5 minutes | The list behind the studio's own pages. |
| GET /v1/games/{universeId} | 5 minutes | Read out of the same list. |
| GET /v1/limits | 1 hour | A static list that changes only when the limits page does. |
| GET /v1/limits/{id} | 1 hour | Read out of the same list. |
| Every keyed endpoint | not cached | The answer is yours alone; `cache-control: no-store`. |

## Headers

A keyless answer carries `cache-control: public, s-maxage=N, stale-while-revalidate=2N` and open CORS. A keyed answer carries `cache-control: no-store` and no CORS header at all: an answer to a request with an `Authorization` header is never cached at the edge, by the CDN's own rule, and a browser cannot call a keyed endpoint, on purpose. Errors are never cached.

## From a browser

A page on any domain may fetch the keyless endpoints directly; preflights are answered for `GET` and `OPTIONS`. Keep keys out of pages: a keyed call from a browser fails its preflight, and a key in a script is a leaked key.