Skip to content

Safety

You are right to be suspicious of any site that asks you to sign in with Roblox. Here is how to check us.

Last updated 31 August 2026

What RoAuction will never ask you for

  • Your Roblox password. Not on our site, not by email, not in Discord.
  • Your .ROBLOSECURITY cookie. There is no legitimate reason for any site to want it.
  • A Roblox API key. Roblox policy prohibits asking a user for one, so a site that asks has told you what it is.
  • Remote access to your machine, or a "verification" download.

Anyone claiming to be RoAuction support and asking for any of the above is not us. Support will never message you first on Discord.

How our Roblox sign-in actually works

We use Roblox's own OAuth flow. You are sent to roblox.com, approve a specific list of permissions there, and come back with an access token. You never type a credential into anything of ours.

Signing in requests exactly two permissions:

  • openid confirms which Roblox account you are.
  • profile gives your username, display name, avatar and account creation date.

The full set our app is registered for is below. Anything past the first two is requested later, one at a time, and only if you attach game or group data to a listing.

openidprofile

Checking that a page is really us

  • The consent page must be on apis.roblox.com. If the address bar says anything else, close it.
  • The client_id in that URL must be exactly:8438942646747297831
  • We show you a preview of the consent screen on the sign-in page before you click anything. If what you land on looks different, stop.
  • Roblox gives an app no way to prove it is legitimate. Until that exists, the checks above are what you have, from us and from everyone else.

Revoking our access

You can remove RoAuction's access from your own Roblox account settings at any time. We do not control that page and cannot stop you or undo it.

Open your Roblox authorised apps

Revoking freezes the verified data on your listings and we will prompt you to reconnect. Your account, bids and purchases are unaffected. That is why we ask for an email address.

Buying safely

  • Never move the deal off-platform. A seller who asks you to pay by Robux, PayPal, gift card or group funds is trying to leave the only system that can get your money back.
  • Ask in the listing's public Q&A rather than in DMs. It keeps the answer on the record.
  • Actually open the files before you confirm. Confirming is what releases the money.
  • Read the licence. Single-use means one game; exclusive means the seller can never sell it again.
  • Check the seller's Roblox account age and tier badge. Both are on every listing.

Selling safely

  • Turn on two-factor before you need it. It is required before your first payout anyway.
  • Deliver only through RoAuction. A file sent by Discord is a file with no delivery log behind it, and in a dispute that log is your defence.
  • Do not bid on your own listings, or ask someone on your network to. Same-IP bidding between seller and bidder is an automatic hold, not a warning.
  • Answer questions. Silence is the most common reason a listing stalls, and the most cited thing in disputes.

If something goes wrong

Open a dispute from your purchases page. It freezes the seller's payout immediately, before anything has left the platform.

If your Roblox account may be compromised, change the password and revoke every authorised app first, ours included, then contact us. Securing the account comes before anything to do with a listing.