How Studcheck verifies a Roblox account
This is the whole mechanism, written down. It is short because there is not much to it, and that is the point: the fewer moving parts a verification tool has, the less it can get wrong with your account.
The flow, step by step
You send /verify to the bot. It replies with one button. That button opens a URL on apis.roblox.com — Roblox's own domain, not ours.
Roblox shows you a consent screen listing exactly what Studcheck is asking for. You approve or you do not. If you approve, Roblox sends the bot a short-lived code, which the bot exchanges for a token on the server. The bot then asks Roblox who you are, and Roblox answers.
That answer — your user id, username, display name and avatar — is what gets stored, alongside your Telegram id. Nothing else passes between the two.
The two permissions
Studcheck requests the openid and profile scopes. On Roblox's consent screen these appear as Read user id and Read user profile, both marked Low risk by Roblox.
Neither lets the bot act as you. It cannot post, trade, spend Robux, join groups, change settings, or read anything private. It can learn who you are, and that is all. A verification tool asking for more than that should make you suspicious.
What the bot never sees
Your password. You type it on Roblox's site, if you are not already signed in. It never reaches us and there is no field for it anywhere in the bot.
Your .ROBLOSECURITY cookie. That is the session token that would let someone act as you. OAuth exists precisely so tools never need it.
Anything you did not approve. Roblox enforces the scopes on its side. Even if the bot asked for more, Roblox would not answer.
Why this beats the profile-code method
The older approach has you paste a code into your Roblox profile description so a bot can read it back. It works, but it trains players that pasting unfamiliar strings into their profile is normal — which is exactly the habit account stealers rely on. It also proves only that you could edit that profile at that moment.
OAuth proves it to Roblox, not to us. Roblox vouches for the identity directly, and the bot never touches your profile.
The signed state
When the bot builds that login link, it includes a signed token tying the request to your Telegram id, valid for fifteen minutes. The signature is checked in constant time when Roblox sends you back.
This is the detail that stops someone linking their Roblox account to your Telegram id, or replaying an old link. It is invisible to you, which is how it should be.
After you verify
A verification is a snapshot, so the bot re-checks. Every hour it asks Roblox whether verified accounts have been banned since, and removes members whose accounts have. Usernames and display names are refreshed when you run /whoami, because both can change; the link itself is keyed on your Roblox id, which cannot.
Send /unlink and the link is deleted immediately. There is no cooling-off period and nothing to confirm by email, because we have no email.
What is stored
One record per link: your Telegram id, your Roblox id, the username, display name and avatar URL Roblox returned, and the date. The privacy page lists everything, including what moderators add and what group owners cause us to keep.
No access tokens are kept. The bot uses the token once, to ask who you are, and discards it.
What it does not prove
OAuth proves you controlled that Roblox account at the moment you signed in. It cannot prove the account has not been sold, shared or stolen since, and it says nothing about whether you are trustworthy. Moderators should treat it as one strong signal rather than a guarantee — which is why the hourly re-check exists.
If you find something in this description that does not match the bot's behaviour, that is a bug, and we would like to know.