Downloading files

com.roblox.client · target ABI x86_64 · status page

One route, and the whole point of the API:

GET /download/{version}

Examples, all valid:

https://robloxandriod.com/download/2.734.917
https://robloxandriod.com/download/2.734.917.apk
https://robloxandriod.com/download/latest

latest means the newest version this server holds, which is not necessarily the newest version that exists — if the newest release has no x86_64 artifact it was never archived. The X-Roblox-Version header on the response says exactly what you are getting, so you never have to guess.

It is a redirect, and that is deliberate

The response is 302 with a Location pointing at Cloudflare R2, where the file actually lives. The bytes come from Cloudflare's network, never through this server: a ~220 MB APK does not pass through a small hosting plan on every request, and the transfer runs at Cloudflare's speed rather than this box's.

Practically, that means your client must follow redirects:

curl -L -o roblox.apk https://robloxandriod.com/download/latest      # -L is required
wget --content-disposition https://robloxandriod.com/download/latest    # follows by default
python: requests.get(url, allow_redirects=True, stream=True)

The redirect target is signed and expires (about 60 minutes). Follow it immediately. Never store it, never put it in a config file, never hand it to a queue that might run tomorrow — request /download/{version} again instead. The path never expires; the URL it points at always does.

Headers on the redirect

Header	Value
`X-Roblox-Version`	The version actually being served, e.g. `2.734.917`.
`X-Roblox-Version-Code`	Android versionCode, when known.
`X-Roblox-Kind`	`apk` or `xapk`.
`X-Roblox-Sha256`	Hex sha256 of the file you are about to receive.
`X-Roblox-Size-Bytes`	Exact size, for a progress bar or a disk-space check.
`X-Roblox-Filename`	Suggested name, e.g. `roblox-2.734.917.apk`.

Use HEAD to read all of that without downloading anything:

curl -sI https://robloxandriod.com/download/latest

Getting the URL instead of the redirect

Add ?json=1 to be told where the file is rather than being sent there. Useful when the downloader is a separate process from the thing deciding what to download.

curl -s "https://robloxandriod.com/download/latest?json=1"

{
  "version": "2.734.917",
  "fileName": "roblox-2.734.917.apk",
  "kind": "apk",
  "sizeBytes": 231014912,
  "sha256": "9f2c...",
  "url": "https://<account>.r2.cloudflarestorage.com/...",
  "expiresAt": "2025-08-17T22:04:00.000Z"
}

Verify the hash

Every stored file has a real sha256, computed by this project while copying the bytes. The public mirror publishes no digest, so that copy is the only moment one can be learned — which is exactly why it is worth checking.

sha256sum roblox.apk
# compare against X-Roblox-Sha256, or .files[0].sha256

A mismatch means a truncated download far more often than anything sinister. Delete and retry; do not install it.

apk and xapk are not interchangeable

apk — one universal file containing every ABI. pm install or adb install takes it directly.
xapk — a zip of split APKs (a base plus per-ABI and per-density parts). It must be installed as a set: unzip it and use adb install-multiple base.apk config.x86_64.apk .... Handing the bundle to a plain install fails.

Check kind before you install. It is the one field that silently breaks an automated flow if ignored.