Roblox Integration

Security rules

Non-negotiable rules for using the Vestrane Lua SDK safely:

  • VestraneConfig.lua, and everything that requires it, must only run in server-side Scripts or ModuleScripts required by them - never a LocalScript, never anything under StarterPlayerScripts/StarterGui/ReplicatedStoragethat a LocalScript reads from. A LocalScript runs on the player's own machine; anything it can read, the player can read, including your location secret.
  • Never hardcode a secret from one location's config into another location's script. Each location in Vestrane has its own independent secret.
  • If you ever suspect a secret has leaked (e.g. a place file was shared publicly with the config still filled in), rotate it immediately from that location's Roblox Integration dashboard page - the old secret stops working the instant you do.
  • The SDK reads the player's Roblox User ID from the server-side Player instance, never from a RemoteEventargument a client could supply - a player's own client is never a trustworthy source for "who am I."

API contract

POST {API_BASE_URL}/api/game/access/check

Headers: Authorization: Bearer <location secret>, Content-Type: application/json

{
  "accessPointId": "uuid",
  "robloxUserId": 123456789,
  "serverJobId": "string",
  "placeId": 123456789,
  "robloxGroups": [{ "groupId": 123456, "rank": 50 }]
}
{
  "allowed": true,
  "reason": "ACCESS_GRANTED_GROUP_RANK",
  "eventId": "uuid",
  "accessPoint": { "id": "uuid", "mode": "normal", "unlockDurationSeconds": 5 }
}

robloxGroupsis optional - omit it and Vestrane resolves the player's group ranks itself via Roblox's public API. Supplying it (via the server's own Player:GetRankInGroup) is faster and avoids an extra outbound call on Vestrane's side.