OAuth is a sign-in standard that lets you prove who you are to a website without ever handing over your password. When you click Continue with Roblox on RBX Invest, you sign in on Roblox's own servers, approve a short list of permissions, and Roblox sends RBX Invest a limited, read-only token instead of your password. That token can confirm which account you are and read your inventory, and nothing else. It cannot spend Robux, trade, buy or sell items, or change anything on your account, and you can cut off its access at any time from your Roblox settings. This article explains how all of that works, in plain language, so you can decide for yourself whether the button is safe to click.
Quick answer: OAuth lets Roblox vouch for you to RBX Invest with a limited token instead of your password, so RBX Invest never sees your password and can only confirm your identity, read your public profile name and read your inventory. Roblox enforces those limits on its own servers, and you can revoke the token any time under Settings and App Permissions.
| Continue with Roblox at a glance | |
|---|---|
| What OAuth is | A sign-in standard where you log in on Roblox and the site gets a limited token, not your password |
| Where you type your password | Only on roblox.com or apis.roblox.com, never on RBX Invest |
| Permissions RBX Invest requests | openid, profile, user.inventory-item:read |
| What the token can do | Confirm your account, read your public name, read your inventory |
| What it can never do | Spend Robux, buy, sell, trade, change settings, or post or chat as you |
| How to revoke it | Roblox Settings, then App Permissions, then remove the app |
What is OAuth, in plain terms? A valet key for your account
Say you hand your car to a valet. You don't give the valet your full keychain, with your house key, your mailbox key and everything else you own. You give them a valet key. It starts the car and nothing more. If you stop trusting the valet, you take the key back, and your other keys were never at risk.
OAuth works the same way for accounts. Instead of giving a website your Roblox password (the full keychain), Roblox issues that website a token, a valet key with a fixed, narrow list of things it can do. The website never sees your password, so it cannot log in as you, and the token only opens the specific doors you approved on the consent screen.
A hotel keycard is another good picture. The front desk (Roblox) checks your ID once, then hands out a card that opens only your room and the gym. The desk can also deactivate the card whenever you ask, without changing your ID or anything else about you.
Three properties make OAuth fundamentally safer than sharing a password:
- The password never leaves Roblox. You only ever type it on Roblox's own site. The third-party app receives a token.
- Permissions are scoped. The token can do exactly what was listed on the approval screen and nothing beyond it. A read-only token stays read-only forever. It cannot be "upgraded" later without you approving again.
- Access is revocable. You can kill the token from your Roblox account settings at any moment, without changing your password or touching anything else.
This is the same mechanism you have probably used elsewhere: "Sign in with Google" and "Sign in with Apple" buttons are OAuth. Roblox runs an official OAuth system for approved third-party apps, documented publicly on its developer site (see the Roblox OAuth 2.0 overview).
What happens when you click "Continue with Roblox"? Five steps, and your password stays on Roblox
Here is the exact sequence, step by step:
- You leave RBX Invest and land on Roblox. Your browser is redirected to
apis.roblox.com, Roblox's official authorization server. Check the address bar: the page asking you to sign in belongs to Roblox. - You sign in to Roblox, on Roblox. If you're already logged in to Roblox in that browser, you skip straight to the next step. Either way, anything you type on this page goes to Roblox only. RBX Invest cannot see this page or what you enter on it.
- Roblox shows you a consent screen. It lists the app's name and exactly which permissions it is requesting. Nothing outside that list is granted. You can approve or cancel, and cancelling simply sends you back with no access given.
- Roblox sends you back with a token. If you approve, Roblox redirects you to RBX Invest along with a token that carries only the approved permissions. Your password made the whole round trip without ever leaving Roblox's servers.
- RBX Invest uses the token for the approved actions only. For us, that means confirming your identity and syncing a read-only copy of your inventory so your portfolio stays up to date.
The exact permissions RBX Invest requests
A scope is the name for one permission on the consent screen. RBX Invest asks for three:
| Scope | What it actually grants |
|---|---|
openid |
Confirms which Roblox account signed in (your user ID). This is how we know you are you. |
profile |
Your public username and display name, so your account shows the right name. |
user.inventory-item:read |
A read-only view of your inventory, used to sync your UGC Limiteds automatically. |
That last scope is part of Roblox's official inventory API, and the :read suffix means exactly what it says. It can only look. (UGC Limiteds are the Limiteds made by community creators, the items the sync pulls into your portfolio.) Roblox documents this API and its permissions on the developer site: User inventories on Roblox Open Cloud.
What the token can never do
Because none of the following permissions are requested (and most are not even available to third-party apps), a token issued to RBX Invest cannot:
- Spend, transfer, or even see your Robux balance
- Buy, sell, or list items for sale
- Send, accept, or modify trades
- Change your password, email, or any account setting
- Post, chat, or act as you anywhere on Roblox
You don't have to take this on trust, because it's how scoped tokens work. Roblox enforces the permission list on its side, so even if you assume the worst about any third-party site, a read-only token physically cannot move your items or Robux. The riskiest thing our token can do is know what's in your inventory, which for most traders is already public on their Roblox profile.
How do you review or revoke access? Settings, then App Permissions, at any time
You stay in control after connecting. Roblox keeps a list of every app you've authorized, with an option to remove each one:
- Log in on the Roblox website and open your account Settings.
- Open the App Permissions section. Every third-party app you've connected via OAuth is listed there.
- Review what each app can access, and remove any app you no longer use or trust.
Revoking access invalidates the token. RBX Invest would simply stop being able to sync your inventory. Your portfolio data on the site freezes in place, and nothing happens to your Roblox account. You can reconnect later with one click if you change your mind. Checking this page once in a while is good hygiene regardless of which apps you use.
How do you tell real OAuth from a phishing page? Check the domain, and never type your password anywhere else
OAuth itself is safe; fake login pages that imitate it are the actual danger. The rules that keep you safe are short:
- Real OAuth always happens on a Roblox domain. When any site offers "sign in with Roblox," the page where you actually enter your password must be
roblox.comorapis.roblox.com. Verify it in your browser's address bar. Logos and layouts are trivial to fake; the domain in the address bar is not. - Never type your Roblox password into a form on any other domain. A legitimate site using OAuth has no password box of its own. It sends you to Roblox. Any site that asks for your Roblox password directly in its own form is not using OAuth and should be treated as a password thief, full stop.
- Read the consent screen before approving. It tells you exactly what the app will be able to do. If an app that only needs to read data asks for broad or write permissions, cancel.
- Beware lookalike domains.
roblox.com.something.netis not Roblox. The Roblox domain ends withroblox.comright before the first/.
RBX Invest will never ask for your password, and no legitimate OAuth app will either. If you ever see an "RBX Invest" page with a Roblox password field on it, it isn't ours. Close it.
Once you're connected, everything else on the site works the same as before. The items leaderboard never needed your account at all, and the sync simply adds your own inventory on top. A few pages do require signing in (Deals asks for an account to keep it fast and fair for real users), but you can browse every Roblox trading guide and most of the site without connecting anything.
Everything in this article about how OAuth and the inventory permission work comes from Roblox's own developer documentation, the OAuth 2.0 overview and the Open Cloud user inventories page linked above.
FAQ
Can RBX Invest steal my Robux or items?
No. The token Roblox issues to RBX Invest is read-only. It carries no permission to spend Robux, list or sell items, trade, or modify your account in any way, and Roblox enforces those limits on its own servers. The token's only powers are confirming your identity, reading your public profile name, and reading your inventory list.
Does RBX Invest see my Roblox password?
No, never. You type your password only on Roblox's own website (apis.roblox.com / roblox.com), and it never leaves Roblox's servers. RBX Invest receives a limited token after you approve the consent screen. If you're already signed in to Roblox in your browser, you won't type a password at all.
How do I disconnect RBX Invest from my Roblox account?
Log in on the Roblox website, open account Settings, and go to the App Permissions section. Find RBX Invest in the list of connected apps and remove it. The token is invalidated, inventory syncing stops immediately, and nothing on your Roblox account changes. You can reconnect any time.
Is OAuth the same as giving someone my account?
No, it's closer to the opposite. Giving someone your account means sharing a password that unlocks everything: Robux, trades, settings, chat. OAuth shares a token limited to the exact permissions on the consent screen, which for RBX Invest is identity plus a read-only inventory view. The token can't be used to log in to Roblox as you, and you can revoke it in seconds without changing your password.
Which permissions does RBX Invest ask for?
Three scopes: openid (confirms which Roblox account signed in), profile (your public username and display name), and user.inventory-item:read (a read-only view of your inventory, used to sync your UGC Limiteds). The :read suffix means the token can look at your inventory but never change it.
What happens to my portfolio if I revoke access?
Your portfolio data on RBX Invest freezes in place, because the site can no longer sync your inventory. Nothing happens to your Roblox account, and you can reconnect with one click later if you change your mind.
How do I know a "sign in with Roblox" page is real?
Check the address bar. A real OAuth sign-in page is on roblox.com or apis.roblox.com, and the Roblox domain ends with roblox.com right before the first /. A lookalike such as roblox.com.something.net is not Roblox, and any site with its own Roblox password box is not using OAuth at all.
Do I have to connect my Roblox account to use RBX Invest?
No. The items leaderboard and every trading guide work without an account. Connecting adds your own inventory on top so your portfolio stays synced, and a few pages such as Deals ask you to sign in to keep them fast and fair for real users.