Roblox Discord bots: group ranks, verification and game data

A Discord bot for Roblox links each member's Discord account to their Roblox account, then keeps their Discord roles in step with their rank in your Roblox group. A custom one can also change ranks from Discord, read your game's saved data, and turn appeals and applications into actions on Roblox. I build them on Roblox's Open Cloud APIs and your own Discord application.

If linking and rank roles are all you need, don't pay for a custom bot. RoVer says it's free for every server with no paywalls, and Bloxlink's free plan covers 50 role binds (September 2026). Custom work pays off when staff want to change ranks from Discord, when roles depend on your game's own data, or when an accepted appeal should lift a game ban without anyone opening Roblox.

What a Discord bot for Roblox does

For members

1. They run /verify and sign in on Roblox's own page. The bot receives their Roblox user ID, never their password, then gives them the roles for their group rank and sets their nickname to their Roblox username.
2. To join your group, they run /apply and fill in a short form. Discord's pop-up forms hold up to five questions. When staff approve, the bot accepts their pending join request on Roblox.
3. If they're banned from your game, /appeal opens a form in your appeals server. An accepted appeal lifts the ban, and a rejected one tells them why.

For your staff

• Rank changes from Discord. /rank set changes a member's group rank, with your rules for who may promote to what. Every change is logged.
• Roles that stay correct. Ranks changed on Roblox reach Discord on /update, when a member rejoins, and in a scheduled sync.
• Game data. /stats reads a player's saved data, and announcements can go to every live server of your game.

Linking Roblox accounts

There are four legitimate ways to verify a Roblox account in Discord, and I usually combine two. Captchas and other checks are covered under verification bots.

• Roblox sign-in (OAuth 2.0). The member approves your app on Roblox, and the bot gets the sub claim, which is their Roblox user ID. Roblox warns against using usernames as identifiers because members can change them. New apps are limited to 10 users until Roblox reviews them, which takes a demo video and a written justification for the scopes. Roblox still labels OAuth 2.0 as beta.
• Discord's own Roblox connection. Members who connected Roblox under Discord's Settings > Connections can share it when they sign in with Discord, through the connections scope. No Roblox app review is needed, but it only works for members who connected it. Discord's deeper Roblox integration, with verified roles and cross-bans, is only available in official servers for specific games.
• Links members already made. Bloxlink has a developer API that looks up the Roblox account a member linked, using an API key for your server. Members who verified with Bloxlink don't have to do it again.
• A profile code. The member pastes a one-time code into the About section of their Roblox profile, and the bot reads it through Roblox's public users endpoint, which also returns the account's creation date. Slower for members, but no app review.

Group rank sync with Roblox Open Cloud

Everything here comes from Roblox's Open Cloud reference as of September 2026, where the group endpoints are still marked beta. Open Cloud can list a group's roles, list memberships filtered by user or role, assign and unassign roles, and accept or decline join requests. Members can now hold several roles at once, and the old endpoint that set a single rank is deprecated.

• Authentication. An API key with the group:read and group:write scopes, sent in an x-api-key header. It acts with the permissions of the Roblox account that owns it: it can change roles below that account's highest role, never its own. Roblox recommends a separate account for automation that holds only the rank it needs. Keys expire after 60 days without use and can be locked to your host's IP address.
• What Open Cloud can't do. Removing members and group bans still require an account cookie, so I leave those to staff on Roblox.
• Rate limits. 300 requests a minute per key owner for memberships and role changes, and 100 a minute for accepting join requests. A sync therefore reads the group in pages of up to 100 members and only acts on members whose rank changed.

This is the core of /rank set. It checks the rank is on your ladder, assigns that rank's role and removes any other ladder rank the member holds, leaving extra roles alone. It reads roles, because the role field shows only the highest one. Tested on Node 22.22.2 and 24.15.0 against a mock server enforcing the documented paths, filters, page sizes and bodies, including multi-role members, a 429 and a wrong key. On Roblox's live API, each route returns 401 Invalid API Key for a bad key, not a 404.

// roblox-rank.js: change a member's rank in a Roblox group through Open Cloud.
// Node 22+ (built-in fetch). The API key needs group:read and group:write, and it
// acts with its owner's group role, so that account can only set ranks below its own.
const BASE = 'https://apis.roblox.com/cloud/v2';
const GROUP = process.env.ROBLOX_GROUP_ID;
// The ranks staff move people between, e.g. "1,10,20,30". Other roles a member
// holds, such as an "Event Team" role on top of their rank, are left alone.
const LADDER = (process.env.ROBLOX_RANK_LADDER ?? '').split(',').filter(Boolean).map(Number);

async function openCloud(path, body) {
  for (let attempt = 1; ; attempt++) {
    const res = await fetch(`${BASE}/${path}`, {
      method: body ? 'POST' : 'GET',
      headers: { 'x-api-key': process.env.ROBLOX_API_KEY, 'content-type': 'application/json' },
      body: body && JSON.stringify(body),
      signal: AbortSignal.timeout(10_000),
    });
    if (res.status === 429 && attempt < 4) {
      await new Promise((resolve) => setTimeout(resolve, 2 ** attempt * 1000)); // 2, 4, 8 s
      continue;
    }
    if (!res.ok) throw new Error(`Open Cloud ${res.status} on ${path}: ${await res.text()}`);
    return res.json();
  }
}

// Staff think in ranks (0-255); the API wants role paths like "groups/7/roles/99513316".
async function listRoles() {
  const roles = [];
  let pageToken = '';
  do {
    const next = pageToken ? `&pageToken=${encodeURIComponent(pageToken)}` : '';
    const page = await openCloud(`groups/${GROUP}/roles?maxPageSize=20${next}`);
    roles.push(...(page.groupRoles ?? []));
    pageToken = page.nextPageToken ?? '';
  } while (pageToken);
  return roles;
}

async function setRank(robloxUserId, rank) {
  if (!LADDER.includes(rank)) throw new Error(`Rank ${rank} is not in ROBLOX_RANK_LADDER`);
  const filter = encodeURIComponent(`user == 'users/${robloxUserId}'`);
  const [member] = (await openCloud(`groups/${GROUP}/memberships?filter=${filter}`)).groupMemberships ?? [];
  if (!member) throw new Error(`Roblox user ${robloxUserId} is not in group ${GROUP}`);

  const roles = await listRoles();
  const target = roles.find((r) => r.rank === rank);
  if (!target) throw new Error(`Group ${GROUP} has no role with rank ${rank}`);

  // A user ID works in place of a membership ID.
  const membership = `groups/${GROUP}/memberships/${robloxUserId}`;
  await openCloud(`${membership}:assignRole`, { role: target.path });
  for (const path of member.roles ?? [member.role]) {
    const held = roles.find((r) => r.path === path);
    if (path !== target.path && held && LADDER.includes(held.rank)) {
      await openCloud(`${membership}:unassignRole`, { role: path });
    }
  }
  return target;
}

module.exports = { setRank, listRoles };

Game data: DataStores, MessagingService and bans

The same kind of API key, with the matching scopes, reaches your game.

• DataStores. The bot can read and update entries, for /stats or to grant an item after a support ticket. Open Cloud shares its request budget with your live game servers: reads are capped at 300 plus 40 per concurrent user per minute. I rate-limit the bot so it never starves the game.
• MessagingService. The bot can publish a message to every live server, such as an event start or a shutdown notice. Topics are up to 80 characters and messages up to 1 KiB, and your game must subscribe to the topic in Luau first.
• Bans. Roblox's Ban API bans or unbans a player, for a set time or permanently, with a reason the player sees (up to 400 characters) and a private one for staff. Alt accounts are banned too unless you exclude them. Each player can be updated at most twice a minute, which is plenty for an appeals queue.
• ER:LC. Emergency Response: Liberty County servers get their own Private Server API once the server has bought the game's API pack.

Why a bot should never ask for your .ROBLOSECURITY cookie

Ranking bots built on libraries like noblox.js sign in as a Roblox account with its .ROBLOSECURITY cookie, the value your browser keeps after you log in. Roblox's own API spec says sharing it will "allow someone to log in as you and to steal your Robux and items."

So anyone who asks for it is asking for the account. A "verification" site that wants it pasted, a Discord member who needs it to "fix your rank," a script that reads it from your browser: each one hands the account over. Roblox's help center says never to give out browser cookies, and its Groups reference says not to use cookie authentication in production. A real verification bot never needs your cookie or password, because sign-in happens on roblox.com and the bot only receives your user ID.

If a cookie was shared, go to Settings > Security > Where you're logged in, choose Log Out of All Other Sessions, and change the password.

Bloxlink, RoVer or a custom bot?

Prices from each vendor's own page, September 2026:

RoVer and Bloxlink are built to bring Roblox into Discord, turning ranks, badges and passes into roles, and they do it well. A custom bot earns its price in the other direction, where a decision made in Discord changes something on Roblox. It can also run next to them and reuse their links.

What a custom Roblox Discord bot costs

A focused Roblox bot is a Starter build: from $590, delivered in 1 to 2 weeks. That covers account linking, rank roles for one group, /rank set with a staff log and up to about five slash commands. You get the source code, setup docs, 30 days of bug fixes and the first month of Care.

It becomes Community, from $1,490, when it adds game data, appeals through the Ban API, or applications with join requests, up to three systems sharing one database. A web dashboard or several groups and games is Platform work, from $3,500. The pricing page has the details. If you choose Roblox sign-in, Roblox's app review sits outside my timeline.

How the build works

1. Brief. Send a short brief: your group, your game, which ranks staff may set. I reply within one business day.
2. Spec. We agree on the linking method, rank rules, what gets logged and the API scopes. That list becomes the acceptance checklist.
3. Test. I build against a test group and a private Discord server, and your staff try every command.
4. Launch. The bot goes live on your Discord application. The API key belongs to your automation account, so you can revoke it any time.

I don't have a Roblox case study to show yet. The closest work is the Rivals League setup, which gives 154 teams their roles and channels from the league's roster, and every script has a dry-run mode.

Technical notes

• Intents. Guilds is enough for slash commands. The privileged Server Members intent is added only for checks when someone joins.
• Permissions. Manage Roles, with the bot's role above every role it hands out, and Manage Nicknames for nickname sync. Never Administrator. The guide to adding bots explains role order.
• Data. Discord ID, Roblox user ID and the time they were linked. No cookies or passwords, and the Open Cloud key lives in the host's environment settings, never in the code. Hosting and updates run on Care from $49 a month.