Quickstart

The shortest path from nothing to a working call: create a key, enable HTTP requests in your game, award some XP.

Every URL and header on this page is a placeholder. The base URL, the auth header name and the key format are all still open. This page teaches the shape of a call, not its literal contents.

Before you start

You need:

• A clan you own, on the dashboard
• Its clan ID — TODO: document where this is surfaced in clan settings
• A clan API key — TODO: the key creation UI is not built yet; see Authentication

1. Enable HTTP requests

In Roblox Studio: Game Settings → Security → Allow HTTP Requests.

This is the single most common reason a first call fails. HttpService throws immediately when it is off, and the error does not mention the setting.

2. Make the call

local HttpService = game:GetService("HttpService")

-- TODO: real base URL undecided.
local BASE_URL = "https://API_BASE_URL/v0"

local response = HttpService:RequestAsync({
    Url = BASE_URL .. "/clans/CLAN_ID/members/ROBLOX_ID/xp",
    Method = "POST",
    Headers = {
        -- TODO: header name undecided — `api-key` vs `Authorization: Bearer`.
        ["Authorization"] = "Bearer YOUR_CLAN_API_KEY",
        ["Content-Type"] = "application/json",
    },
    Body = HttpService:JSONEncode({
        amount = 150,
        reason = "Round win",
    }),
})

if response.Success then
    print(HttpService:JSONDecode(response.Body))
else
    warn("Award failed:", response.StatusCode, response.Body)
end

HttpService only works from server scripts. A LocalScript cannot reach this API — and more importantly, a key that reaches the client is a key that has been leaked. Store it server-side and never pass it down.

3. Check the response

A successful award returns the member's updated state:

{
  "robloxId": "ROBLOX_ID",
  "xp": "4200",
  "rank": "Sergeant"
}

TODO: confirm the real response shape. XP is a BigInt server-side and comes back as a decimal string on the existing session-auth routes; the public API should match, but that is not yet decided.

Common failures

Next

• Authentication — how keys are scoped
• Errors — the full status code list