Repository navigation
Account Access
GokuTrap can talk to Roblox on your behalf, but only when you explicitly allow it. This page explains exactly what that means.
When Allow GokuTrap to access your Roblox account is enabled, GokuTrap can make authenticated requests to Roblox's own API on your behalf.
Concretely, that means it can:
- Read your public profile — display name, username, avatar, and user ID.
- Identify which account the Roblox desktop client is currently signed in as.
- Fetch public place and server information that requires authentication.
That is the complete list.
- It never reads, writes, replaces or deletes Roblox's protected cookie file.
- It never touches your browser profile or any browser cookie store.
- It never stores a credential. There is no password, token or cookie field anywhere in GokuTrap's settings file — see Security-and-Privacy.
- It never sends your session to any host other than Roblox. The request host is validated before the cookie is attached.
- It never signs you out, and never signs you in.
- It never polls silently. Refresh is something you trigger.
Roblox itself saves an authentication cookie for your current Windows user, encrypted with Windows DPAPI. GokuTrap decrypts that existing value using the same current-user scope, and uses it only for requests to Roblox.
GokuTrap clears and zeroes its in-memory copy when it is no longer needed, and invalidates the cached session if Roblox returns an HTTP 401.
The setting lives under Saiyan & feature tools → Accounts.
| State | What works |
|---|---|
| Off (default) | Public profiles work. Desktop identity validation does not |
| On | Desktop session validation becomes available |
Turning it off takes effect immediately and drops the cached session.
See Account-Profiles for the full flow. In short:
- GokuTrap opens Roblox's official sign-in page in your browser, after you confirm.
- You sign in there, if necessary.
- You press Refresh & validate session.
Signing in on the web does not always authenticate the desktop client — they can hold different sessions. Sign in in the official Roblox desktop client, then refresh.
Choosing which profile is "current" in GokuTrap only changes a label in GokuTrap's interface. Roblox's authenticated session is unchanged.
Roblox exposes no supported API for a launcher to switch desktop sessions, so GokuTrap does not attempt it. See Platform-Limits.
- Account-Profiles — managing profiles
- Security-and-Privacy — what is stored and what is sent
- Bootstrapper-Behaviour — where the cookie setting lives