OAuth is a sign-in standard that lets you prove who you are to a website without ever handing over your password. When you click Continue with Roblox on RBX Invest, you sign in on Roblox's own servers, approve a short list of permissions, and Roblox sends RBX Invest a limited, read-only token instead of your credentials. That token can confirm which account you are and read your inventory - nothing else. It cannot spend Robux, trade, buy or sell items, or change anything on your account, and you can cut off its access at any time from your Roblox settings. This article explains how all of that works, in plain language, so you can decide for yourself whether the button is safe to click.
What Is OAuth, in Plain Terms?
Think about handing your car to a valet. You don't give the valet your full keychain - your house key, your mailbox key, everything you own. You give them a valet key: it starts the car and nothing more. If you stop trusting the valet, you take the key back, and your other keys were never at risk.
OAuth works the same way for accounts. Instead of giving a website your Roblox password (the full keychain), Roblox issues that website a token - a valet key with a fixed, narrow list of things it can do. The website never sees your password, so it cannot log in as you, and the token only opens the specific doors you approved on the consent screen.
A hotel keycard is another good picture. The front desk (Roblox) checks your ID once, then hands out a card that opens your room and the gym - not the manager's office, not the safe. The desk can also deactivate the card whenever you ask, without changing your ID or anything else about you.
Three properties make OAuth fundamentally safer than sharing a password:
- The password never leaves Roblox. You only ever type it on Roblox's own site. The third-party app receives a token, not credentials.
- Permissions are scoped. The token can do exactly what was listed on the approval screen and nothing beyond it. A read-only token stays read-only forever - it cannot be "upgraded" later without you approving again.
- Access is revocable. You can kill the token from your Roblox account settings at any moment, without changing your password or touching anything else.
This is the same mechanism you have probably used elsewhere: "Sign in with Google" and "Sign in with Apple" buttons are OAuth. Roblox runs an official OAuth system for approved third-party apps, documented publicly on its developer site (see the Roblox OAuth 2.0 overview).
What Happens When You Click "Continue with Roblox"?
Here is the exact sequence, step by step:
- You leave RBX Invest and land on Roblox. Your browser is redirected to
apis.roblox.com- Roblox's official authorization server. Check the address bar: the page asking you to sign in belongs to Roblox, not to RBX Invest. - You sign in to Roblox, on Roblox. If you're already logged in to Roblox in that browser, you skip straight to the next step. Either way, anything you type on this page goes to Roblox only. RBX Invest cannot see this page or what you enter on it.
- Roblox shows you a consent screen. It lists the app's name and exactly which permissions it is requesting. Nothing outside that list is granted. You can approve or cancel - cancelling simply sends you back with no access given.
- Roblox sends you back with a token. If you approve, Roblox redirects you to RBX Invest along with a token that carries only the approved permissions. Your password made the whole round trip without ever leaving Roblox's servers.
- RBX Invest uses the token for the approved actions only. For us, that means confirming your identity and syncing a read-only copy of your inventory so your portfolio stays up to date.
The exact permissions RBX Invest requests
| Scope | What it actually grants |
|---|---|
openid |
Confirms which Roblox account signed in (your user ID). This is how we know you are you. |
profile |
Your public username and display name, so your account shows the right name. |
user.inventory-item:read |
A read-only view of your inventory, used to sync your UGC Limiteds automatically. |
That last scope is part of Roblox's official inventory API, and the :read suffix means exactly what it says - it can look, not touch. Roblox documents this API and its permissions on the developer site: User inventories on Roblox Open Cloud.
What the token can never do
Because none of the following permissions are requested (and most are not even available to third-party apps), a token issued to RBX Invest cannot:
- Spend, transfer, or even see your Robux balance
- Buy, sell, or list items for sale
- Send, accept, or modify trades
- Change your password, email, or any account setting
- Post, chat, or act as you anywhere on Roblox
This isn't a promise you have to take on trust - it's how scoped tokens work. Roblox enforces the permission list on its side, so even if you assume the worst about any third-party site, a read-only token physically cannot move your items or Robux. The riskiest thing our token can do is know what's in your inventory, which for most traders is already public on their Roblox profile.
How to Review or Revoke Access at Any Time
You stay in control after connecting. Roblox keeps a list of every app you've authorized, with an option to remove each one:
- Log in on the Roblox website and open your account Settings.
- Open the App Permissions section. Every third-party app you've connected via OAuth is listed there.
- Review what each app can access, and remove any app you no longer use or trust.
Revoking access invalidates the token. RBX Invest would simply stop being able to sync your inventory - your portfolio data on the site freezes in place, and nothing happens to your Roblox account. You can reconnect later with one click if you change your mind. Auditing this page once in a while is good hygiene regardless of which apps you use.
How to Tell Real OAuth From a Phishing Page
OAuth itself is safe; fake login pages that imitate it are the actual danger. The rules that keep you safe are short:
- Real OAuth always happens on a Roblox domain. When any site offers "sign in with Roblox," the page where you actually enter credentials must be
roblox.comorapis.roblox.com- verify it in your browser's address bar, not in the page's design. Logos and layouts are trivial to fake; the domain in the address bar is not. - Never type your Roblox password into a form on any other domain. A legitimate site using OAuth has no password box of its own - it sends you to Roblox. Any site that asks for your Roblox password directly in its own form is not using OAuth and should be treated as a credential thief, full stop.
- Read the consent screen before approving. It tells you exactly what the app will be able to do. If an app that only needs to read data asks for broad or write permissions, cancel.
- Beware lookalike domains.
roblox.com.something.netis not Roblox. The Roblox domain ends withroblox.comright before the first/.
RBX Invest will never ask for your password, and no legitimate OAuth app will either. If you ever see an "RBX Invest" page with a Roblox password field on it, it isn't ours - close it.
Once you're connected, everything else on the site works the same as before: the items leaderboard never needed your account at all, and the sync simply adds your own inventory on top. A few pages do require signing in - Snags asks for an account to keep it fast and fair for real users - but you can browse every article and most of the site without connecting anything.
FAQ
Can RBX Invest steal my Robux or items?
No. The token Roblox issues to RBX Invest is read-only. It carries no permission to spend Robux, list or sell items, trade, or modify your account in any way - and Roblox enforces those limits on its servers, not us. The token's only powers are confirming your identity, reading your public profile name, and reading your inventory list.
Does RBX Invest see my Roblox password?
No, never. You type your password only on Roblox's own website (apis.roblox.com / roblox.com), and it never leaves Roblox's servers. RBX Invest receives a limited token after you approve the consent screen. If you're already signed in to Roblox in your browser, you won't type a password at all.
How do I disconnect RBX Invest from my Roblox account?
Log in on the Roblox website, open account Settings, and go to the App Permissions section. Find RBX Invest in the list of connected apps and remove it. The token is invalidated, inventory syncing stops immediately, and nothing on your Roblox account changes. You can reconnect any time.
Is OAuth the same as giving someone my account?
No - it's closer to the opposite. Giving someone your account means sharing a password that unlocks everything: Robux, trades, settings, chat. OAuth shares a token limited to the exact permissions on the consent screen, which for RBX Invest is identity plus a read-only inventory view. The token can't be used to log in to Roblox as you, and you can revoke it in seconds without changing your password.