noblox.js

In noblox.js, EventEmitters allow you to receive real-time data updates for specific Roblox events (such as group shouts or notifications).

To use an EventEmitter, call a function that returns an emitter instance and use the .on(event, callback) method to register listeners for specific event types.

Supported Events

• connect: Emitted when noblox.js successfully connects to Roblox and starts the emitter.
• data: Emitted when noblox.js detects a change on Roblox. The change details are passed as a parameter to your callback function.
• close: Emitted when noblox.js disconnects from Roblox and the emitter stops.

const noblox = require("noblox.js");
const Emitter = noblox.onShout(1);

Emitter.on("connect", function() {
    console.log("noblox is listening for a shout change!")
})

Emitter.on("data", function(newStatus) {
    console.log("The group status has been updated! New status:", newStatus);
})

Emitter.on("close", function() {
    console.log("noblox has closed the emitter!");
})

To start using noblox.js, you must first retrieve your .ROBLOSECURITY cookie. You must call setCookie() and await its completion before calling any authenticated methods.

Note: This library is promise-based. Always await your calls to ensure authentication is established before subsequent API requests are made.

const noblox = require('noblox.js')
async function startApp () {
    // You MUST call setCookie() before using any authenticated methods [marked by 🔐]
    // Replace the parameter in setCookie() with your .ROBLOSECURITY cookie.
    const currentUser = await noblox.setCookie('_|WARNING:-DO-NOT-SHARE-THIS.--Sharing-this-will-allow-someone-to-log-in-as-you-and-to-steal-your-ROBUX-and-items.|_6E6F626C6F782E6A73') 
    console.log(`Logged in as ${currentUser.UserName} [${currentUser.UserID}]`)

    // Do everything else, calling functions and the like.
    const groupInfo = await noblox.getGroup(9997719)
    console.log(groupInfo)
}
startApp()

To use noblox.js to perform actions on behalf of a Roblox account, you must provide a .ROBLOSECURITY cookie. This cookie represents your authentication session.

Steps to obtain the cookie:

1. Open an Incognito/Private window in your browser.
2. Sign into the Roblox account you intend to use for your bot.
3. Open the browser's Developer Tools and navigate to the Storage/Application section to find Cookies for www.roblox.com.
4. Locate the key named .ROBLOSECURITY and copy its value.

Important Security Notes:

• Never share your cookie. It grants full access to your account.
• Do not sign out of the account in the incognito window after copying the cookie; simply close the window. Signing out will invalidate the session.
• If hosting on a VPS, cookies may be locked by IP region. You may need to generate the cookie remotely on the same network/region as your server.

The async/await pattern allows you to write asynchronous code that looks synchronous. You can use the await keyword to pause execution until a Promise resolves.

Constraints:

• The await keyword can only be used inside a function marked with the async keyword.
• When an async function is called, it returns a Promise, not the direct value. You must await the result of the async function itself if you need the returned value.

const noblox = require("noblox.js");

// await can only be used in async functions!
async function DemoteUser (groupId, username) { 
  // await will yield the code until a value is returned.
  const userId = await noblox.getIdFromUsername(username).catch(function(error) {
    console.log("There was an error getting the id!", error)  
  }); // Handle the rejection accordingly.
	
  if (!userId) return console.log("No id was returned.");
  noblox.demote(groupId, userId); // Use the value returned to demote the user.
}

DemoteUser(1, "popeeyy");

Because Roblox locks .ROBLOSECURITY cookies to a specific IP region, you cannot simply log in on your local machine and copy the cookie to a VPS. You must generate the cookie from the VPS itself. The most effective method is using an SSH SOCKS tunnel to route your local browser traffic through your VPS IP.

Prerequisites

• A dedicated VPS with a static IP.
• SSH access to the VPS.
• Note: Free hosts with dynamic IPs (e.g., Repl.it, Glitch, Heroku) are not compatible and will fail.

Setup Steps

1. Prepare the VPS: Connect via SSH and whitelist a port (e.g., 1234) in your firewall to allow the tunnel traffic.

   ssh your_user@your_server_ip
   sudo ufw allow 1234

2. Establish the Tunnel: Reconnect to your VPS using the -D flag to start a SOCKS proxy on the whitelisted port.

   ssh -D 1234 your_user@your_server_ip

   Note: There may be no visual confirmation of success in the terminal; this is expected.

3. Proxy your Browser: Open a new terminal instance (use Git Bash or cmd, avoid WSL) and launch your browser in incognito/private mode configured to use the SOCKS proxy.

   Google Chrome:

   start chrome --incognito --proxy-server="socks5://localhost:1234" https://www.roblox.com/login

   Microsoft Edge:

   start msedge --inprivate --proxy-server="socks5://localhost:1234" https://www.roblox.com/login

4. Retrieve and Secure the Cookie:

   • Log in to Roblox via the proxied browser window.
   • Retrieve the .ROBLOSECURITY cookie as you normally would.
   • Copy the cookie to your VPS (e.g., into a .env file).
   • CRITICAL: Close the incognito window without clicking "Log Out". Clicking logout will invalidate the session.

5. Cleanup: Remove the firewall rule to maintain security.

   sudo ufw delete allow 1234

Important Security Warning

Once the cookie is created, the VPS is the only IP authorized to use it. If you attempt to use the account or the cookie from any other IP without the tunnel, the cookie will be invalidated by Roblox's security checks.

# 1. Whitelist port
ssh your_user@your_server_ip
sudo ufw allow 1234

# 2. Start tunnel
ssh -D 1234 your_user@your_server_ip

# 3. Launch proxied browser (New Terminal)
start chrome --incognito --proxy-server="socks5://localhost:1234" https://www.roblox.com/login

# 4. Cleanup
sudo ufw delete allow 1234

If you encounter the error Cannot get CSRF: You are not logged in. or Authorization has been denied for this request, it means an authenticated method was called without a valid session.

Common Causes:

1. Missing Cookie

You have not called setCookie() before attempting to use authenticated methods. Solution: Call setCookie(your_cookie) before making other API calls.

2. Improper Promise Handling

Because setCookie is asynchronous and returns a Promise, the cookie is not available immediately after the function is called. If you attempt to run authenticated code before the setCookie promise resolves, the request will fail.

Solutions:

• Using .then(): Place all authenticated logic inside the .then() block.
• Using async/await: You must await noblox.setCookie(...) and ensure any subsequent authenticated code is either within the same async function or called only after the await has completed.