Downloading files

Windows · macOS · Android · home

One route, on every platform:

GET /download/{platform}/{version}

Examples, all valid:

https://rbxoffsets.com/download/windows/version-ddf602d9cfe44005
https://rbxoffsets.com/download/macos/version-89863375b5194afb
https://rbxoffsets.com/download/android/2.734.917
https://rbxoffsets.com/download/android/2.734.917.apk
https://rbxoffsets.com/download/windows/latest

latest means the newest version this server holds for that platform, which is not necessarily the newest version that exists — on Android, if the newest release has no x86_64 artifact it was never archived. The X-Roblox-Version header on the response says exactly what you are getting, so you never have to guess.

A bare /download/{version} with no platform still works and still means Android. That was the only form when this API was first published and it will keep answering; new clients should name the platform.

What you get, per platform

It is a redirect, and that is deliberate

The response is 302 with a Location pointing at Cloudflare R2, where the file actually lives. The bytes come from Cloudflare's network, never through this server: a 134 MB client zip does not pass through a small hosting plan on every request, and the transfer runs at Cloudflare's speed rather than this box's.

Practically, that means your client must follow redirects:

curl -L -o RobloxApp.zip https://rbxoffsets.com/download/windows/latest   # -L is required
wget --content-disposition https://rbxoffsets.com/download/windows/latest    # follows by default
python: requests.get(url, allow_redirects=True, stream=True)

The redirect target is signed and expires (about 60 minutes). Follow it immediately. Never store it, never put it in a config file, never hand it to a queue that might run tomorrow — request the /download/ path again instead. The path never expires; the URL it points at always does.

Headers on the redirect

Use HEAD to read all of that without downloading anything:

curl -sI https://rbxoffsets.com/download/windows/latest

Getting the URL instead of the redirect

Add ?json=1 to be told where the file is rather than being sent there. Useful when the downloader is a separate process from the thing deciding what to download.

curl -s "https://rbxoffsets.com/download/windows/latest?json=1"

Verify the hash

Every stored file has a real sha256, computed by this project while copying the bytes. Neither the Android mirror nor Roblox's CDN publishes one, so that copy is the only moment one can be learned — which is exactly why it is worth checking.

sha256sum RobloxApp.zip
# compare against X-Roblox-Sha256, or .files[0].sha256

A mismatch means a truncated download far more often than anything sinister. Delete and retry; do not use it.

Windows has a second, independent check. Roblox publishes an MD5 per package in <version>-rbxPkgManifest.txt, and this project verifies the download against it before storing anything — so a Windows object in the bucket has been checked against a digest we did not compute ourselves. The manifest is archived beside the zip if you want to repeat that check. macOS publishes no digest at all, which is why its files are pinned only by our own sha256.

apk and xapk are not interchangeable

• apk — one universal file containing every ABI. pm install or adb install takes it directly.
• xapk — a zip of split APKs (a base plus per-ABI and per-density parts). It must be installed as a set: unzip it and use adb install-multiple base.apk config.x86_64.apk .... Handing the bundle to a plain install fails.

Check kind before you install. It is the one field that silently breaks an automated flow if ignored.