Oauth 2.0 move?? help... (your thoughts)

Hi everyone...

Comment your thoughts below this may be a big change and needs big feedback. Because of this I will allow this post to free tier members and the public.

Why?

The current API's are bound to be deleted someday. We can see this with their most recent deprecations: https://devforum.roblox.com/t/official-list-of-deprecated-web-endpoints/62889/93

They are deprecating legacy endpoints almost every 10-20 days in favor of updating them to OAuth. Its only a matter of time before the ones we use get converted.

The OAuth Switch

OAuth is the only way forward.

OAuth has a lot of the new APIs. Currently as it stands it seems Roblox will add more and more features, without support for cookies. This is completely fair, cookies are very dangerous to pass around.

OAuth is a lot safer too, it lets you get a key and you can limit what the key has access to on your account. It also has an authorization flow which you can see here:

This would be hugely beneficial to me and us as the community if I could move on to actual documented APIs.

The Ugly

Under normal circumstances the limit would then be decreased from the current 3000 to 60 uploads per minute... But there is a small glimmer of hope for speed which is to make an oauth app. This allows us to go to 1000 uploads per minute. But, you need to be ID verified. To go past just 10 users you would need to have Roblox manually verify you app.

I am unwilling to do this. So, my idea was we could do community hosted oauth apps.

But there are questions. How does this work for bad actors using your app? Can it be linked to you and get you banned?

I really don't know right now... Are community shared apps even a good idea?

Maybe a solution would to allow people to use their oauth account keys(60 per minute) OR use their oauth app keys (1000 per minute, but max of 10 accounts at a time) [unless you can get your app verified somehow]...

Oauth apps may be the best solution, but its mainly for personal use. The problem is, many are not willing to ID verify themselves. Post some comments, DM me on discord, let me know what you guys think.

Thank you for reading,

Alek