Issue
A new API key authenticates but receives a forbidden or permission-denied response.
Cause
The key lacks the exact universe, resource, or operation scope, or the request targets a different owner.
Fix
Confirm the resource owner and universe ID, then grant the narrow required operation to that key. Verify endpoint version and request path. Never put Open Cloud credentials in a LocalScript, public repository, or browser-delivered PHP page.
Verify
Call one read-only endpoint from a secure server, then add write permission only if the workflow requires it.
Official Roblox API security update recap
#1
Original Heliotrope guidance with authoritative Roblox sources.