How to Add Chat Moderation to a Roblox Game (Beyond TextFilter)

Step-by-step: TextFilter, then Paxmod

There is no Roblox SDK. You call Paxmod with HttpService from a server Script. Keep Roblox filtering on for displayed chat. The product setup checklist lives on the Roblox integration page. To paste a sample and see a #### tag preview (Paxmod, not Roblox TextService), use the Roblox filter checker.

1. 1. Enable HTTP requests and keep TextFilter

   Game Settings → Security → Allow HTTP Requests: ON. Without that, HttpService:PostAsync throws. Leave Roblox TextFilter (or TextChatService, which filters its own channels) in place for every string you show. Paxmod is an extra layer, not a substitute.

2. 2. Get a Paxmod API key

   Copy a key from the project's Settings in the console, or create a no-signup test key (100 messages over 72 hours):

   curl -X POST https://www.paxmod.com/api/v1/agent-key \
     -H "Content-Type: application/json" \
     -d '{"name":"my-roblox-game","source":"roblox"}'

   Store the key on the server only. In production, add PAXMOD_API_KEY as a Creator Hub secret. A key in a LocalScript is readable by every player.

3. 3. Filter with TextService:FilterStringAsync

   If you use TextChatService channels, Roblox already filters those messages. For custom chat or other user text, call FilterStringAsync on the server. If Roblox filtering fails, do not show the message.

   local TextService = game:GetService("TextService")
   
   -- Required: filter user text before anyone else sees it.
   -- If this fails, do not display the message.
   local function filterForDisplay(message, fromUserId)
       local ok, filterResult = pcall(function()
           return TextService:FilterStringAsync(message, fromUserId)
       end)
       if not ok then
           warn("Roblox TextFilter failed:", filterResult)
           return nil
       end
   
       local broadcastOk, filtered = pcall(function()
           return filterResult:GetNonChatStringForBroadcastAsync()
       end)
       if not broadcastOk then
           warn("Roblox TextFilter broadcast failed:", filtered)
           return nil
       end
   
       return filtered
   end

4. 4. POST to Paxmod from a server Script

   After Roblox filtering succeeds, POST the original message to POST /api/v1/text. The field is message, not text. user_id and context_id are optional and should be the player UserId and the room or server instance. PostAsync yields, so call it from a server event handler, not from code that must return immediately.

   local HttpService = game:GetService("HttpService")
   
   local TEXT_URL = "https://www.paxmod.com/api/v1/text"
   -- Server Script only. Never put a key in a LocalScript.
   local API_KEY = "YOUR_API_KEY"
   
   -- Additional layer: run AFTER Roblox filtering, never instead of it.
   -- Send the original message so grooming and PII checks see the real text.
   local function moderateWithPaxmod(message, userId, contextId)
       local payload = HttpService:JSONEncode({
           message = message,
           user_id = tostring(userId),
           context_id = contextId,
       })
   
       local headers = {
           ["Content-Type"] = "application/json",
           ["Authorization"] = "Bearer " .. API_KEY,
       }
   
       local ok, response = pcall(function()
           return HttpService:PostAsync(
               TEXT_URL,
               payload,
               Enum.HttpContentType.ApplicationJson,
               false,
               headers
           )
       end)
   
       if not ok then
           -- Fail open: Roblox filtering already ran. Do not block chat on a Paxmod outage.
           warn("Paxmod unavailable:", response)
           return nil
       end
   
       return HttpService:JSONDecode(response)
   end

5. 5. Branch on content_moderation.flagged

   That boolean is the field you must branch on. reason names the categories that tripped. content_moderation.categories carries a score, threshold, and flagged value per category. Display the Roblox-filtered string, never the raw message.

   -- Server Script in ServerScriptService.
   -- 1. Filter with Roblox. 2. Score with Paxmod. 3. Display only filtered text.
   
   local filtered = filterForDisplay(message, player.UserId)
   if filtered == nil then
       return -- Roblox filtering failed: do not show the message
   end
   
   local result = moderateWithPaxmod(message, player.UserId, "global-chat")
   
   if result and result.content_moderation and result.content_moderation.flagged then
       -- Extra policy hit (grooming-risk, PII, custom rules). Warn, mute, or log.
       warn(player.Name .. " flagged: " .. (result.reason or "policy"))
       return
   end
   
   -- Display `filtered` (Roblox TextFilter output), never the raw message.

   Roblox caps HttpService at 500 requests per minute per server. On a busy experience, batch or sample rather than calling per message. Paxmod allows 600 requests per minute per project. Scoring takes about 500ms. A ready-made ModuleScript is on the Roblox integration page if you would rather require a module than paste HttpService yourself.

Roblox chat moderation requirements

Roblox, not Paxmod, sets the platform rules for user text. The required part is Roblox's own filter. Extra APIs are optional.

• All user-generated text shown to other players must go through Roblox's filter: TextService:FilterStringAsync (TextFilter), or TextChatService for its chat channels.
• You cannot bypass that filter. You cannot replace it with Paxmod, a word list, or any other API.
• If Roblox filtering fails, do not display the message. That is the opposite of Paxmod's fail-open behavior, which only applies to the extra layer.
• HttpService calls must run on the server. Enable Allow HTTP Requests. Never ship an API key in a LocalScript.

What TextFilter does not cover

TextFilter is the required baseline for profanity and other disallowed text. It is not a full trust and safety stack for your game.

• Grooming-risk patterns. A polite conversation can move a child to Discord or ask for a school name without using banned words. Paxmod adds grooming-risk signals developed with the Australian Institute for Machine Learning. See the grooming detection write-up.
• Context and custom game rules. Standard mode scores 13 categories (including Sexual, Self-Harm, PII, Harassment, Threatening, and Profanities). Advanced mode enforces a policy you write in plain English, with no model training.
• Review queues. Flagged results include a reason and per-category scores you can log for trust and safety review. Paxmod is COPPA-oriented (PII detection, age-appropriate thresholds, grooming-risk signals). It is not COPPA-certified.

Frequently asked questions