Authentication

Lithos needs a Roblox ROBLOSECURITY cookie and an Open Cloud API key for almost every deploy. Add S3 credentials only if you use remote state.

Credentials at a glance

ROBLOX_OPEN_CLOUD_API_KEY and the legacy MANTLE_* names are also accepted — see Migrating from Mantle.

ROBLOSECURITY

The same browser cookie Roblox uses for roblox.com (opens in a new tab) and Roblox Studio. Lithos tries to read it for you first:

• If Roblox Studio is signed in on this machine, Lithos can usually read the cookie from the OS keychain.
• Otherwise, set it explicitly:

export ROBLOSECURITY="…"

Extracting the cookie manually

If automatic detection does not find the cookie:

1. Sign in to roblox.com (opens in a new tab) in any modern browser.
2. Open DevTools → Application → Cookies → https://www.roblox.com.
3. Copy the value of the .ROBLOSECURITY cookie.
4. In CI, store it as a secret named ROBLOSECURITY.

LITHOS_OPEN_CLOUD_API_KEY

Use this in all new setups. ROBLOX_OPEN_CLOUD_API_KEY and the legacy MANTLE_OPEN_CLOUD_API_KEY still work.

To create one:

1. Open the Creator Hub credentials page (opens in a new tab).
2. Create a new API key.
3. Under Access Permissions, add the experiences this project deploys to.
4. Grant the scopes Lithos needs:
   • universe-places:write — publishing places.
   • asset:read, asset:write — uploading image and audio assets.
5. Optionally restrict the key by IP.

LITHOS_OPEN_CLOUD_API_KEY="…"

Deploy preflight checks this key before apply when it can — missing or mis-scoped keys fail early.

AWS credentials (remote state only)

If you use remote state, Lithos needs S3-compatible credentials with read/write access to the state object.

LITHOS_AWS_ACCESS_KEY_ID="…"
LITHOS_AWS_SECRET_ACCESS_KEY="…"

For workloads running with an AWS role, set:

LITHOS_AWS_INHERIT_IAM_ROLE=1

and Lithos will use the ambient role instead of explicit keys. R2-specific setup lives on Cloudflare R2 remote state.

Using a .env file

Lithos automatically loads .env from both the project root and the current working directory. This is the recommended way to keep secrets locally.

ROBLOSECURITY="…"
LITHOS_OPEN_CLOUD_API_KEY="…"
 
# Only if using remote state:
LITHOS_AWS_ACCESS_KEY_ID="…"
LITHOS_AWS_SECRET_ACCESS_KEY="…"

.env
.env.*

In CI, inject the same values as repository secrets — see Continuous deployment.

Next steps

• Run your first deployUse the credentials you just configured against the sample project.
• Set up remote stateShare state between machines using S3 or Cloudflare R2.
• Continuous deploymentWire credentials into a CI pipeline gated by branch.