--- title: "Secure Player Authentication & Registration" description: "❗Pre-Release ❗ **Note:** The Namazu Elements Roblox Kit is currently in pre-release. To access the Roblox Support in Namazu Elements please reach out and request access using our [Contact Us Form](https://namazustudios.com/contact-us/). One of the core features of the Namazu Elements…" url: "https://namazustudios.com/docs/add-ons/roblox/secure-player-authentication-registration/" updated: "2026-08-13" category: "Add-Ons / Roblox" --- # Secure Player Authentication & Registration ❗Pre-Release ❗ **Note:** The Namazu Elements Roblox Kit is currently in pre-release. To access the Roblox Support in Namazu Elements please reach out and request access using our [Contact Us Form](https://namazustudios.com/contact-us/). One of the core features of the Namazu Elements Roblox Kit is **secure player authentication**. When a player first joins your game, a server script can use the kit to **authenticate the player with Namazu Elements**. This is done via a single HTTP request from a server-side script (using Roblox’s `HttpService`) to the kit’s authentication endpoint, providing your Namazu [Application](https://namazustudios.com/glossary/application/) [id](https://namazustudios.com/glossary/id/) and the player’s Roblox UserId. The result is a **[Session](https://namazustudios.com/glossary/session/) token** (called a `sessionSecret`) that uniquely identifies the player’s [Session](https://namazustudios.com/glossary/session/) with Namazu Elements. All subsequent requests to Namazu services in this [Session](https://namazustudios.com/glossary/session/) must include this token for authorization. This authentication flow doubles as a **player registration** step – if the player doesn’t already have a Namazu account, the kit will automatically create a new Namazu *[User](https://namazustudios.com/glossary/user/)* and *[Profile](https://namazustudios.com/glossary/profile/)* linked to their Roblox [User](https://namazustudios.com/glossary/user/) [id](https://namazustudios.com/glossary/id/). The kit even uses Roblox’s API to fetch basic [Profile](https://namazustudios.com/glossary/profile/) information (like the player’s username or avatar) and populate the Namazu [Profile](https://namazustudios.com/glossary/profile/) on first signup. This means each Roblox player is seamlessly onboarded into Namazu Elements **without any additional input** or manual account creation. The entire process is designed with security in mind: it **runs only on server-side scripts** using your Namazu [Application](https://namazustudios.com/glossary/application/) Secret (never on the client), so that players cannot tamper with it. Your [Application](https://namazustudios.com/glossary/application/) Secret is used to verify the request and should be stored safely in Roblox’s secure Secrets storage, not in any client-facing code. Once authenticated, the player’s [Session](https://namazustudios.com/glossary/session/) token can be stored server-side (for example, in a variable or server memory) for as long as the player is in game, and used to call other Namazu [Element](https://namazustudios.com/glossary/element/) services on behalf of that player. In short, the Roblox Kit provides a **secure, Roblox-trusted login mechanism** into Namazu’s system: leveraging the player’s Roblox identity and Roblox’s secure server scripts to establish a Namazu [Session](https://namazustudios.com/glossary/session/). ## Step-by-Step Guide The following steps are required to register a Roblox [User](https://namazustudios.com/glossary/user/) in Namazu Elements. Once you register a [User](https://namazustudios.com/glossary/user/) and obtain a [Session](https://namazustudios.com/glossary/session/), you can make API calls against the Namazu Elements API. Creating sessions ensures that users are automatically kept in-sync between Roblox and Namazu Elements. ### 1. Login to the Management Portal Visit your instance of Namazu Elements by pointing our browser to https://your-instance.example.com/admin/ ![](https://namazustudios.com/wp-content/uploads/2026/01/image-1.png) ### 2. Create an [Application](https://namazustudios.com/glossary/application/) Navigate to Applications → Create [Application](https://namazustudios.com/glossary/application/) ![](https://namazustudios.com/wp-content/uploads/2026/01/image-2-1024x514.png) 📝Architecture Notes We recommend making a separate Namazu Elements [Application](https://namazustudios.com/glossary/application/) per Roblox Experience. This ensures that players have unique and independent Profiles per published Experience. See more on [Users and Profiles](https://namazustudios.com/docs/namazu-elements-core/features/users-and-profiles/). ### 3. Deploy the Roblox Kit to the Instance At the time of this writing, Namazu Roblox Kit is distributed as a separate [Element](https://namazustudios.com/glossary/element/). Refer to the [Custom Code](https://namazustudios.com/docs/custom-code/element-structure/) section on how to install the [Element](https://namazustudios.com/glossary/element/) to your instance. In addition to the standard deployment process, it is necessary to configure the RobloxKit Secret to ensure secure communication between Roblox's server and Namazu Elements. To set this, deploy the [Element](https://namazustudios.com/glossary/element/) with the following configuration set. (Changed `` to a secret of your choice). ```javascript dev.getelements.robloxkit.secret= ``` ⚠️ Guard this Secret ⚠️ This secret provides access to your Namazu Elements instance. If it is leaked, change it immediately and update all code. If a malicious third party finds this secret, they can essentially masquerade as any valid Roblox player. #### 4. Verify Roblox Secret was Set Correctly Once deployed, check that the Roblox Kit deployed successfully. Verify: - A "Green Light" appears next to the [Application](https://namazustudios.com/glossary/application/) [name](https://namazustudios.com/glossary/name/) in the left bar, indicating successful deployment. - There are no errors in the [Application](https://namazustudios.com/glossary/application/) logs - That the configured secret appears in the Management Portal ![](https://namazustudios.com/wp-content/uploads/2026/01/image-4-1024x801.png) ### 5. Verify Registration Works Correctly Using your preferred RESTful client, make an API call to the instance authorizing a [User](https://namazustudios.com/glossary/user/). - **HTTP Method:** `POST` - **URI:**`/app/REST/roblox/auth` - Header: `RobloxKit-Secrret: ` - Body `{"robloxUserId":xxxxxxxx, "Application":"my_application"}` For quick reference, the following [Curl](https://curl.se/) command will test your instance: ``` curl -d '{"application":"my_app", "robloxUserId":"XXXXXXXXXXXX"}' -H "Content-Type: application/json" -H "RobloxKit-Secret: " https://my-instance.example.com/app/rest/roblox/auth ``` ### 6. Check that the [Profile](https://namazustudios.com/glossary/profile/) Matching the Roblox Player exists in Namazu Elements Navigate to Profiles on the left hand navigation menu and find the [Profile](https://namazustudios.com/glossary/profile/) matching the Roblox [User](https://namazustudios.com/glossary/user/) you tested against. ![](https://namazustudios.com/wp-content/uploads/2026/01/image-5-1024x801.png)