The Developer section holds the things you use to connect Evalyn to something else.
Scripts & Modules
Where you generate the Roblox handler script. See The Roblox handler for what it does and how to install it.
Remember that generating a script rotates your workspace API secret and invalidates the previous copy.
API keys
Separate from the handler secret. API keys are for calling Evalyn from outside Roblox — your own tooling, a website, another bot.
Each key carries:
- A name, so you can tell them apart later.
- Scopes — the specific permissions it grants.
- A rank ceiling — the highest rank it may promote someone to. Zero means it cannot change ranks at all.
- An optional expiry.
The rank scope is separate
change_ranks is the one scope that a wildcard * does not cover. It has to be granted explicitly, and it does nothing unless the key also has a rank ceiling above zero. A key that can do "everything" still cannot promote anyone unless you said so in as many words.
Handling keys
A key is shown once, when it is created. Store it somewhere appropriate — a secrets manager, an environment variable — and never in client-side code or a public repository.
If a key leaks, delete it. Deleting is immediate.
The HTTP API
Full endpoint reference is at /docs/api — clocking shifts, logging activity, moderating players, reading staff status, and promoting or demoting members.