RBXDepot API Documentation

Use the RBXDepot Public API to automate Robux gamepass purchases using your account balance. Each endpoint below includes an overview, example usage, and the most important error codes.

Base URL

https://rbxdepot.com

Required Authentication Header

Authorization: Bearer <your_api_key>

Overview

Execute a Robux gamepass purchase. This endpoint charges your RBXDepot balance, matches you with the best listing at or below your target rate, and completes the purchase on Roblox.

HEADERS

Request headers

Authorization: Bearer sk_live_your_api_key_here
Content-Type: application/json

BODY

Request body

{
  "gamepassUrlOrId": "https://www.roblox.com/game-pass/123456789/MyGamepass",
  "targetRatePerThousandUsd": 4.50
}

cURL Request Example

curl -X POST https://rbxdepot.com/api/public/purchase \
  -H "Authorization: Bearer sk_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "gamepassUrlOrId": "https://www.roblox.com/game-pass/123456789/MyGamepass",
    "targetRatePerThousandUsd": 4.50
  }'

Success Response Example

{
  "success": true,
  "orderId": "clx1234567890abcdef",
  "gamepassId": "123456789",
  "amount": 1000,
  "ratePerThousandUsd": 4.25,
  "costUsd": 4.25
}

Error Response Example

{
  "error": "Insufficient supply at or below selected rate",
  "code": "NO_SUPPLY"
}

Relevant error codes

400

INVALID_REQUEST

Missing or invalid request body (gamepassUrlOrId is required).

400

INVALID_GAMEPASS

Invalid gamepass URL/ID or the gamepass has a zero price.

400

GAMEPASS_FETCH_ERROR

Failed to fetch gamepass information from Roblox.

401

INVALID_API_KEY

Invalid, missing, or inactive API key.

402

INSUFFICIENT_BALANCE

Account balance is insufficient for the purchase.

409

NO_SUPPLY

No supply available at or below the requested rate.

500

PURCHASE_FAILED

Purchase execution failed and the user was refunded.

500

ROBLOX_AUTH_ERROR

Roblox authentication error for the vendor account.

500

INTERNAL_ERROR

Unexpected server error while processing the purchase.

Webhooks

Receive real-time notifications about balance alerts and order completions via webhooks. All webhooks include a signature that you can verify to ensure they're from RBXDepot.

Balance Alert Webhook

Triggered when your balance drops below a configured USD threshold after a purchase.

Payload

{
  "type": "balance_alert",
  "balanceBefore": 50.00,
  "balanceAfter": 45.75,
  "threshold": 50.00,
  "timestamp": "2025-01-01T12:00:00.000Z",
  "sign": "abc123def456..."
}

Order Notification Webhook

Triggered when a purchase completes via the API.

Payload

{
  "type": "order_notification",
  "orderId": "clx1234567890abcdef",
  "gamepassId": "123456789",
  "robuxAmount": 1000,
  "costUsd": 4.25,
  "ratePerThousandUsd": 4.25,
  "balanceBefore": 50.00,
  "balanceAfter": 45.75,
  "status": "COMPLETED",
  "timestamp": "2025-01-01T12:00:00.000Z",
  "sign": "abc123def456..."
}

Verifying Webhook Signatures

Always verify webhook signatures to ensure they're from RBXDepot. The signature is generated using MD5 hash of the base64-encoded JSON payload combined with your webhook secret.

Algorithm

The signature is calculated as: MD5(base64(JSON.stringify(payload)) + webhookSecret)

TypeScript Example

import crypto from 'crypto';

function generateSign(payload: object, webhookSecret: string): string {
  const payloadString = JSON.stringify(payload);
  const base64Payload = Buffer.from(payloadString).toString('base64');
  const hash = crypto
    .createHash('md5')
    .update(base64Payload + webhookSecret)
    .digest('hex');
  return hash;
}

function isValidWebhookSign(payload: object, receivedSign: string, webhookSecret: string): boolean {
  // remove sign from payload before verification
  const { sign, ...payloadWithoutSign } = payload as any;
  const expectedSign = generateSign(payloadWithoutSign, webhookSecret);
  return receivedSign === expectedSign;
}

// example usage
app.post('/webhook', (req, res) => {
  const payload = req.body;
  const receivedSign = payload.sign;
  const webhookSecret = process.env.WEBHOOK_SECRET; // your webhook secret from dashboard
  
  if (!isValidWebhookSign(payload, receivedSign, webhookSecret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // process webhook...
  res.json({ success: true });
});

JavaScript Example

const crypto = require('crypto');

function generateSign(payload, webhookSecret) {
  const payloadString = JSON.stringify(payload);
  const base64Payload = Buffer.from(payloadString).toString('base64');
  const hash = crypto
    .createHash('md5')
    .update(base64Payload + webhookSecret)
    .digest('hex');
  return hash;
}

function isValidWebhookSign(payload, receivedSign, webhookSecret) {
  // remove sign from payload before verification
  const { sign, ...payloadWithoutSign } = payload;
  const expectedSign = generateSign(payloadWithoutSign, webhookSecret);
  return receivedSign === expectedSign;
}

// example usage
app.post('/webhook', (req, res) => {
  const payload = req.body;
  const receivedSign = payload.sign;
  const webhookSecret = process.env.WEBHOOK_SECRET; // your webhook secret from dashboard
  
  if (!isValidWebhookSign(payload, receivedSign, webhookSecret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // process webhook...
  res.json({ success: true });
});

Python Example

import hashlib
import base64
import json

def generate_sign(payload, webhook_secret):
    payload_string = json.dumps(payload, separators=(',', ':'))
    base64_payload = base64.b64encode(payload_string.encode()).decode()
    hash_input = base64_payload + webhook_secret
    return hashlib.md5(hash_input.encode()).hexdigest()

def is_valid_webhook_sign(payload, received_sign, webhook_secret):
    # Remove sign from payload before verification
    payload_without_sign = {k: v for k, v in payload.items() if k != 'sign'}
    expected_sign = generate_sign(payload_without_sign, webhook_secret)
    return received_sign == expected_sign

# Example usage
@app.route('/webhook', methods=['POST'])
def webhook():
    payload = request.json
    received_sign = payload.get('sign')
    webhook_secret = os.environ.get('WEBHOOK_SECRET')  # Your webhook secret from dashboard
    
    if not is_valid_webhook_sign(payload, received_sign, webhook_secret):
        return jsonify({'error': 'Invalid signature'}), 401
    
    # Process webhook...
    return jsonify({'success': True})

Important: Always verify webhook signatures before processing. The webhook secret is available in your API project settings in the dashboard. Never expose your webhook secret in client-side code.