👥 Multi-Account Management
AssetFlow supports managing multiple Roblox accounts simultaneously, so you can upload assets across different accounts without logging in and out.
Account Types
Cookie-based (.ROBLOSECURITY)
Cookie-based accounts are used for scanning Roblox Studio places. The .ROBLOSECURITY cookie authenticates you with Roblox’s legacy API.
- Add as many cookies as you need
- Each cookie must be from a valid Roblox session
- Cookies are stored locally and never sent anywhere
API Key-based (Open Cloud)
API keys are used for uploading assets (animations, audio, meshes, decals). Each key requires:
- A Roblox User ID (the owner of the key)
- The following scopes:
asset:read,asset:write,asset-permissions:write
Without an API key, you can scan and browse assets, but you cannot upload/reupload them.
Adding Accounts
- Go to the Accounts page in AssetFlow
- Under Cookie (.ROBLOSECURITY), paste your cookie value and click Save Token
- Under Open Cloud API Key, paste your key, enter your User ID, and click Save Key
- Each account appears in the Connected Accounts list with its Roblox display name
Managing Accounts
In the Connected Accounts section, each entry shows:
- The account’s Roblox display name and avatar
- The account type (cookie / API key)
- A Remove button to disconnect it
Flow+ & Flow Max
- Flow: 1 account
- Flow+: up to 5 accounts
- Flow Max: up to 100 accounts
You must first log in with Discord before you can add accounts. The Discord gateway is the first screen you see when launching AssetFlow — adding cookies and API keys comes after authentication.
Which Account is Used?
When you scan a place, AssetFlow uses your cookie accounts to look up asset ownership information.
When you upload, AssetFlow uses your API key account. If you specify a Group ID in the upload configuration, the API key must have the appropriate permissions on that group resource.
Switching
There’s no need to “switch” between accounts — all connected accounts are available simultaneously. AssetFlow intelligently routes requests based on what is needed:
- Scanning → uses cookie accounts
- Fetching ownership → uses cookie accounts
- Uploading personal assets → uses your API key
- Uploading group assets → uses your API key (with group-scoped permissions)