Operations infrastructure for Roblox
Track who actually worked, pay them for it, and prove every change.
Rostack is the operations platform for Roblox studios and communities that have outgrown spreadsheets and unmaintained bots. Your game reports the hours, Rostack turns them into ranks and payroll, and ranking runs on an official Open Cloud key you create and can revoke. You never paste your account cookie.
- No account cookie for ranking
- Immutable audit log
- Built for Roblox groups
Platform
Everything a serious community runs on, in one console.
Every module is off until you add it, so a small group is not handed the whole catalogue on day one. Rostack replaces the patchwork of ranking bots, Discord webhooks and spreadsheets with one system of record that can show its work.
Activity tracking
A module you drop into your game reports minutes played, messages sent and idle time for every staff member. Nothing is self-reported, and a retried report overwrites rather than counting twice, because these numbers decide who gets paid.
Sessions and shifts
Trainings, shifts and events your staff claim, host and take a register for. Slots are claimed in a transaction, so two people cannot take the same one, and every attendee is marked passed or failed with a note.
Payroll from tracked work
Turn the hours you measured into a payout run: everyone over quota, everyone who hosted, at your rates. The preview shows the arithmetic that put each person on the list, and the run still needs two people to approve it before a Robux moves.
Ranking that follows the work
Rules are data: promote on activity, tenure, quota or application outcome. Every run is previewed before it touches Roblox and capped, so a bad rule cannot empty your hierarchy. Rank 255 is never assignable.
Staff, roles and conduct
Staff are the people in the Roblox roles you nominate, tracked whether or not they ever sign in. Permissions map to those roles, so a demotion in Roblox removes access here. Applications, time off, handbook and conduct records included.
Audit log and drift
Every privileged action is recorded with actor, before and after state, reason and trace ID, append-only in the database itself. An hourly sweep diffs your group against Rostack and surfaces changes made anywhere else.
Trust model
Two paths, and we are honest about both.
Most Roblox tools ask for your account cookie and never explain why. Rostack uses the official API wherever one exists, and tells you plainly where one does not.
Ranking
Official Open Cloud, no cookie
Roblox exposes group role assignment as a first-class API. You create an Open Cloud key in the Roblox Creator Dashboard, scope it to this one group, and paste it once. Revoke it there and Rostack loses that power the same second. We never see a password or a session cookie.
- Auth
- Open Cloud API key
- Scope
- group:write, one group
- Credential held
- Yes, KMS encrypted
- Revocable by you
- Creator Dashboard
POST /cloud/v2/groups/{id}/memberships/{id}:assignRole
Payouts
Legacy credential, quarantined
Roblox publishes no Open Cloud payout API; the endpoint accepts only a session credential. So payouts run in a separate service with its own identity, unreachable from the internet, and the keys are split: the app can encrypt that credential and is permanently unable to read it back. Only the payout service holds decrypt.
- Auth
- .ROBLOSECURITY
- Storage
- Cloud KMS + Secret Manager
- Isolation
- Dedicated service
- Before release
- Two people approve
POST groups.roblox.com/v1/groups/{id}/payouts
If a tool asks for your cookie just to rank members, it is using an outdated method. That has been unnecessary since Roblox shipped group writes to Open Cloud. We only ask for a credential for the one operation that still has no alternative, and we isolate it accordingly.
Verified against Roblox's published OpenAPI document
Audit
Every change leaves a record you can hand to someone.
Hours worked, rank changes, payroll, registers and drift all land in one append-only log with the actor, the reason and a trace ID. Switching a module off hides its page and never its record. Nobody edits history afterwards, not your staff, and not us.
- Privileged actions logged
- 100%Privileged actions logged
- Entries editable after the fact
- 0Entries editable after the fact
- People needed to release a payout
- 2People needed to release a payout
Audit log
- intake
Join request accepted for velvetmoss
rule · Auto-accept verified
- drift
Drift detected: 3 members ranked outside Rostack
reconciler · flagged for review
- payout
Payout run #1043 settled, 128 recipients
prepared by wren · approved by rowan
- payroll
Payroll drafted from tracked hours, 128 recipients
rule · over 300 min this week · 64,000 R$
- rank
Aviatrix_dev promoted to Senior Moderator
rule · met the weekly quota
Pacing
Bulk ranking is a queued job, not a click.
Roblox rate-limits group writes. Tools that hide this either fail halfway through your group or get your access throttled. Rostack paces deliberately below the ceiling, leaves headroom for your own tooling, and reports real progress you can watch.
Re-rank 5,000 members
| Mode | Roblox ceiling | Rostack paces at | Duration |
|---|---|---|---|
| Open Cloud keyWhat Rostack uses | 300/min | 240/min | 21 min |
| OAuth grantRoblox's other path, for comparison | 90/min | 72/min | 1.1 hr |
Figures come from Roblox's published rate limits, not an estimate. Jobs are resumable, so a throttle or a restart continues where it stopped.
Security
What we actually do with your data,
in checkable sentences.
No adjectives. Each of these describes a control in the running system, and the security page explains every one of them in enough detail to verify.
Encrypted in transit and at rest
TLS on every connection, with HSTS so a browser refuses plain HTTP. Stored data is encrypted at rest on Google Cloud. Anything that is a credential is encrypted a second time with Cloud KMS, on keys that rotate automatically every 90 days.
The website cannot read your payout credential
It holds the permission to encrypt one and not the permission to decrypt it. Only an isolated service with no public address can, so compromising the site yields ciphertext and nothing to open it with.
Ranking never touches your account cookie
It runs on an Open Cloud key you create in Roblox's own dashboard, scoped to one group and revocable there. Rostack stores it encrypted with Cloud KMS, because it has to be replayed to Roblox on every call. The keys Rostack issues to your game servers are different: those are kept only as a SHA-256 hash and cannot be read back at all.
A code at the moment money moves
Payouts need a verified email and an authenticator app, and releasing Robux asks for a fresh code every time. Each code works once. A stolen session cannot release a payout on its own.
An audit log nobody can edit
Every privileged action is written before it runs, with who, why and a trace ID. The log is append-only in the database rules themselves, not merely in application code. Not your staff, and not us.
Your data is yours to take or remove
Download everything we hold about you as a JSON file, or delete your account, from Settings. Both are self-service and immediate. What is retained after deletion is listed, not hidden.
Only what the product needs
A Roblox user ID and username, an avatar URL, an email if you add one, and the work your own game servers report: minutes played, message counts and session attendance. No analytics cookies, no third-party trackers, no advertising, and nothing sold or shared. The one cookie is your session.
Honest about where data lives
On Google Cloud in the United States, under Google's data processing terms, which include the EU standard contractual clauses. Stated plainly because European users are entitled to know it.
FAQ
Straight answers.
The questions people actually ask before trusting a platform with their group and their Robux.
Do I have to give Rostack my account cookie?
Not for ranking, staff management, activity tracking or applications. Those run on an Open Cloud API key you create in the Roblox Creator Dashboard, scoped to one group, which you can revoke there at any moment. A session credential is required only for Robux payouts, because Roblox publishes no official payout API. If you never switch payouts on, Rostack never asks for one.
What stops a bad rule from wrecking my group?
Several things, by design. Rules fail closed, so a rule with no conditions matches nobody rather than everybody. Every run produces a preview you confirm before anything is sent. Runs are capped, high ranks can be protected, and a job can be stopped mid-flight. A rank that would fall outside 0–255 is skipped rather than clamped.
Can a payout ever go out twice?
Each recipient in each run gets an idempotency key generated before execution and checked inside the transaction that marks the line paid, so a retry after an ambiguous failure cannot pay twice. The same discipline runs through activity tracking, which feeds payroll: game servers send cumulative totals rather than increments, so a replayed report overwrites the same record instead of adding to it. Every run needs two different people to approve it, and a schedule firing is not one of them.
How does Rostack know when something changes on Roblox?
Roblox does not publish group webhooks, so anything claiming to be instant is polling too. Rostack sweeps on a schedule, diffs your group against its mirror, sets aside the changes it made itself, and shows you what is left. It cannot tell you who made a change or the exact minute, and it says so rather than inventing a name.
Who can see the audit log?
Anyone you grant the permission to. Entries are append-only in the database itself, not merely in application code, so nobody, including us, edits history after the fact. Every entry records the actor, the before and after state, a reason and a trace ID.
How much does it cost?
Pricing is not live yet, and the shape is settled: staff are unlimited and never counted, on every plan including the free one. The free tier runs a real group, activity tracking, sessions, time off and quotas included. Paid is for automation and scale, chiefly recurring payroll, faster drift sweeps and higher API volume. Charging by headcount would mean charging a community for being popular.
Run your community like it matters.
Connect your group with an official Open Cloud key and have ranking rules running in minutes. No cookie, no spreadsheet, no unmaintained bot.