The Rosterr public API lets your Roblox game (or another server-side tool) talk to your workspace over HTTPS: log staff activity, look up members, create sessions, file moderation cases, read notices and more.
Base address:
https://<your Rosterr address>/api/public/v1/workspace/<workspaceId>Workspace ID: the Roblox group ID of your workspace.
Format: JSON in and out. Every response has
success(true or false), pluserrorwhen it failed.
Create an API key
You need the Create API keys permission (or Admin).
Open Settings > Public API.
Choose to create a key, give it a name (for example "Main game"), and choose when it expires: 30 days, 90 days, 1 year or never.
Copy the key now. It looks like
rosterr_followed by 64 characters.
The full key is shown only once. Rosterr stores only a one-way fingerprint (a SHA-256 hash), so a lost key cannot be recovered. If you lose it, delete it and create a new one.
Rules about keys
A key only works for the workspace that created it.
A key stops working when it expires, when you delete it, or while the workspace is suspended (it is not deleted, so it works again when the suspension ends).
The number of keys depends on your plan: Free 1, Pro 10, Business 25. The limit stops you making more, it never deletes existing ones.
Keys can be removed any time from the same page. Deleting one stops it immediately.
Making and deleting a key is recorded in the audit log (never the key itself).
Use a key
Send it as a bearer token in the Authorization header:
Authorization: Bearer rosterr_<your key>
Keep it secret
Only call the API from server scripts (for example
ServerScriptServicein Roblox). Anything a player's client can read is public.Never put a key in a LocalScript, in ReplicatedStorage, in a public GitHub repository, or in a screenshot.
Use a separate key for each game so you can replace one without breaking the others.
Choose an expiry for keys you use for tests.
If a key leaks, delete it straight away and make a new one.
See when a key was used (newer settings)
Workspaces with the newer settings tools show, for each key, when it was last used, from which address and for which endpoint, or "Never used". Use it to spot a key being used when you did not expect it, and to tidy unused keys. The address is only as reliable as the network in front of Rosterr.
Related articles
Track staff time with the game API (Luau example)
Rosterr game API: endpoints reference
Game API errors and rate limits (401, 404, 409, 429 and how to back off)