API Reference
Every endpoint, with copyable examples and a live explorer.
Held in memory for this tab only, never stored. If you are already signed in at /admin, you can leave this empty — the session cookie authorizes the same routes.
Public
No authentication. These are the endpoints your Roblox loaders call.
Admin — scripts
Send Authorization: Bearer <ADMIN_TOKEN>. The portal at /admin uses a session cookie for the same routes; either credential works.
Admin — key
Operational endpoints for the rotating key.
Error codes
Failures return { "ok": false, "error": "<code>" }, with a human-readable message on validation errors.
| Code | Status | Meaning |
|---|---|---|
| unauthorized | 401 | Missing or wrong bearer token / admin cookie. |
| rate_limited | 429 | Too many requests. Retry-After tells you how long to wait. |
| bad_request | 400 | Request body was not valid JSON. |
| INVALID_SLUG | 400 | Slug is not 3-64 lowercase letters, digits and dashes. |
| INVALID_TITLE | 400 | Title was empty. |
| INVALID_IMAGE_URL | 400 | imageUrl does not start with http:// or https://. |
| EMPTY_SOURCE | 400 | Script source was empty or whitespace only. |
| SLUG_TAKEN | 400 | Another entry already uses that slug. |
| NOT_FOUND | 404 | No entry with that slug. |
| internal_error | 500 | Unexpected server or database failure. |