12 Free Roblox Device Trust API Checks Before You Ship - 2026

If you searched roblox device trust after Roblox announced the Device Trust API on 27 October 2026, you do not need another “ban all cheaters tonight” Discord paste. You need a numbered free checklist before your join hook kicks half of Web, treats Unknown as guilty, or reads Player.DeviceTrustLevel on the client like it is gospel.

Primary sources: Improve Your Game Security with the Device Trust API and Creator Hub Device trust plus Security and cheat mitigation tactics. Ambient platform context: Roblox Cube. The API ships first for Android and Web, using hardware attestation-style signals so you can gate join, trade, chat, or matchmaking by trust level. It does not replace authoritative servers.

This listicle owns the free ship kit. It is not the TextChatService May 2027 lock list (chat cutover). It is not AnimatedImages EAP Stops/what-changed. It is not Unity MCP agent checks. This URL owns Device Trust enablement checks before hard kicks.

Why this matters now

Security FOMO is fast. Staff listed kick-on-join, trade/chat gates, and trusted-only matchmaking as examples. Web testing and Web clients are in the same Creator Week conversation. The trap is a one-line policy: if level ~= Full then Kick(). That line will punish Unsupported / Unknown platforms (iOS, Windows, consoles still coming), Pending players still being checked, and Web players who may report None because the browser path cannot be verified the same way.

Direct answer: Run checks 1–4 before you write production join code. Run 5–9 on a copy place with soft gates and metrics. Run 10–12 before any hard Kick on live. If check 4 fails (no written Unknown policy), stop — Unknown is not “cheater.” Docs: Device trust.

Who this list is for

Time: 25 minutes for 1–4; 2–4 hours for a soft-gate lab.
Honest limit: DevForum + Creator Hub are authority. Platform coverage will expand — re-read docs before you change kick policy.

Non-repetition

Trust levels (memorize before coding)

Announcement launch focus: Android + Web first; iOS, consoles, Windows called out as later. Docs stress: Unknown doesn’t mean untrusted — you decide per game / per feature.

Four-check minimum (twenty-five minutes)

The twelve checks

1. Docs latch (DevForum + Device trust + tactics)

Do: Read the Device Trust announcement, Device trust docs, and skim security tactics so Device Trust is framed as a layer, not the whole anti-cheat.

Pass: Ticket links all three.
Fail: “Forum likes are enough.”
Next: Paste the Unknown sentence into the design doc.

2. Server-only read policy

Do: Staff: do not trust the client-reported value — cheaters can change it locally. Use IntegrityService.EvaluatePlayerDeviceTrust on the server, and/or read Player.DeviceTrustLevel on the server, then tell the client which features are allowed via RemoteEvent/RemoteFunction.

Pass: No client script gates economy on local DeviceTrustLevel.
Fail: LocalScript kick / hide trade UI from client property alone.
Next: Code review grep for DeviceTrustLevel under PlayerScripts.

3. Pending handling

Do: Docs: every player starts Pending while Roblox checks. Your join flow must tolerate Pending (queue, soft lobby, deferred trade) instead of immediate Kick.

Pass: State machine includes Pending → resolved.
Fail: if not Full then Kick on first frame.
Next: Log Pending duration in Studio playtests.

4. Unknown platform policy (written)

Do: Write what Unknown means for join, trade, chat, ranked. Unknown includes unsupported platforms and attestation errors. Kicking all Unknown = kicking many real players on platforms not in the first launch set.

Pass: One-pager with four rows (join/trade/chat/ranked × Unknown action).
Fail: “Unknown = ban.”
Next: Revisit when iOS/Windows support expands.

5. None policy (hard vs soft)

Do: Decide whether None means Kick, spectate-only, or feature strip. Staff allows reject-with-message like Player:Kick(). Soft gates often ship first so you measure false positives.

Pass: None action documented + kick copy drafted if used.
Fail: Silent teleport to void with no message.
Next: A/B soft gate for a week on a copy place if traffic allows.

6. Standard vs Full feature matrix

Do: Do not collapse Standard into None. Use a matrix: e.g. Full+Standard can trade; Full-only for high-risk ranked; Standard allowed in casual.

Pass: Table in the design doc.
Fail: Binary Full-or-kick.
Next: Align with genre risk (trading games vs singleplayer).

7. Web / Android launch honesty

Do: Launch is Android + Web first. Web browser paths may report levels that reflect “can’t verify” more often — docs note Web verification limits. If you ship a Web-heavy experience, a hard Kick-on-None policy can delete your Web funnel.

Pass: Platform mix estimate + Web policy row.
Fail: “Device Trust means Web is safe to hard-ban.”
Next: Pair with your Web playtest habits; still not a publish waiver for unrelated EAPs.

8. Trade / chat / matchmaking gates (not only join)

Do: Prefer feature gates over join bans when learning. Staff examples: trusted-only trade/chat, trusted matchmaking pools. Implement allowlists server-side after trust resolves.

Pass: At least one soft feature gate before any join Kick on live.
Fail: Join Kick as the first and only control.
Next: Matchmaking pool IDs documented.

9. Kick / reject UX copy

Do: If you reject from EvaluatePlayerDeviceTrust, include a clear message (Kick-style). Tell players whether to update OS/app, try another device, or that Web is limited — without accusing children of cheating in the first line.

Pass: Copy reviewed by design/community.
Fail: Empty Kick or “exploiter detected” for Unknown.
Next: Localization plan if you ship multi-language.

10. Metrics before hard Kick on live

Do: On a copy place or soft flag: count Pending/Unknown/None/Standard/Full for a sample of joins. Look at Web vs Android vs other. Only then enable hard Kick on live.

Pass: Histogram attached to the ship ticket.
Fail: Enable Kick Monday with zero counts.
Next: Dashboard or simple DataStore/log sink for a week.

11. Defense in depth (still validate the client)

Do: Staff: Device Trust raises cost; it does not stop weak server validation. Positions, currency, hits still need server authority. Device Trust is the front door; your Remotes are the house.

Pass: Checklist that economy Remotes remain validated.
Fail: “We have Device Trust so client can own coins.”
Next: Cross-link security tactics doc in the PR.

12. Ship receipt + owner sign-off

Do: Producer/eng lead signs: checks 1–11 green, Unknown/None/Web policies attached, server-only review done, metrics sample filed, rollback flag ready (disable Kick without deploy if possible).

Pass: Signed DEVICE_TRUST_SHIP_RECEIPT_v1.
Fail: “Security said ship it.”
Next: Calendar reminder to revisit when new platforms gain support.

Ship receipt template

DEVICE_TRUST_SHIP_RECEIPT_v1
date:
place:
owner:

docs_linked: yes/no
server_only_review: yes/no
pending_policy:
unknown_join:
unknown_trade:
unknown_chat:
unknown_ranked:
none_action:
standard_features:
full_features:
web_policy:
android_policy:
soft_gate_first: yes/no
metrics_sample_attached: yes/no
economy_remotes_still_validated: yes/no
hard_kick_enabled_live: yes/no
rollback_flag:
signer:

Beginner evening path

1. Checks 1–4 on paper (30 min).
2. Lab place: connect EvaluatePlayerDeviceTrust, print levels only (30–45 min).
3. Implement Pending wait + Unknown soft UI (45–60 min).
4. Add metrics counters (30 min).
5. Do not enable live Kick until check 10–12.

Beginner done: You can explain Unknown ≠ cheater and show a server-only listener without a production Kick. If you only remember one sentence from this kit, make it that one — then add metrics before anyone enables Kick.

Developer depth

Callback vs cached property

Lab listener sketch (log-only — adapt to current API names)

On a copy place, server Script pattern in spirit:

1. Connect IntegrityService.EvaluatePlayerDeviceTrust.
2. When (player, level) arrives, append to an in-memory counter table keyed by tostring(level).
3. Do not Kick in week 0.
4. Optionally fire a RemoteEvent TrustResolved with a server-authored allowlist enum (TradeOk, ChatOk, RankedOk) — never the raw enum if you can avoid teaching clients to spoof expectations.
5. For Pending, either ignore or show a “checking device…” soft UI until a non-Pending level arrives.

If staff’s decision-table reject path is what you use later, keep Kick behind a Bindable/flag so metrics week can flip without a full redeploy. Re-read Creator Hub snippets for exact method signatures the morning you implement — API surfaces move.

Genre policy starter (edit for your game)

This table is a starting argument, not Roblox law. Fill check 4–8 with your real numbers.

Suggested soft-gate ladder

1. Week 0: log only.
2. Week 1: hide high-risk UI for None; Unknown allowed with watermark.
3. Week 2: trusted matchmaking pools.
4. Week 3+: optional join Kick for None only — if metrics OK.

False-positive postmortem questions

When Discord claims “Device Trust banned me,” ask:

1. Platform (Web / Android / other)?
2. Was level Pending when they got kicked?
3. Was the message Unknown-hostile (“cheater”) or policy-honest?
4. Did a client LocalScript participate?
5. Can they join with Kick flag off?

Answer those five before you “tighten” the policy again.

KEEP lab / HOLD hard Kick (body)

Excuse ladder

Failure modes

Company / diligence four-liner

1. API: Device Trust (IntegrityService / DeviceTrustLevel) — Android + Web first (Oct 2026).
2. Control: Written Unknown/None/Web policies + server-only enforcement.
3. Limit: Does not replace server validation; coverage incomplete across platforms.
4. Evidence: Metrics sample + signed ship receipt before hard Kick.

Discord-ready brief (paste)

Device Trust checks before hard Kick:
1–4 docs, server-only, Pending, Unknown≠cheat
5–8 None/Standard matrix, Web honesty, soft gates
9–12 UX copy, metrics, defense-in-depth, signed receipt
Don’t Kick Unknown as exploiters. Don’t trust the client property.

What to do Monday

If producers demand “Kick on by Friday,” answer with the histogram requirement from check 10 and the Unknown one-pager from check 4. Security theater that bans Web and Pending players is not diligence — it is a support incident with a fancy API name. Keep the hard Kick flag off until both artifacts exist in the ticket.

Key takeaways

1. Twelve free checks before Device Trust hard Kick.
2. Server-only — never trust client DeviceTrustLevel.
3. Pending is temporary — don’t Kick mid-check.
4. Unknown ≠ untrusted — write a policy.
5. None / Standard / Full need a matrix, not one if.
6. Android + Web first — Web verification differs.
7. Soft feature gates before join bans.
8. Kick copy must be human.
9. Metrics before live Kick.
10. Still validate Remotes — front door ≠ house.
11. Signed receipt to ship.
12. Re-read docs when platforms expand.
13. This kit ≠ TextChat / AnimatedImages / Unity MCP kits.
14. Defense in depth is the real security bar.

FAQ

What is the Roblox Device Trust API?

A server-facing way to learn how trustworthy a joining player’s device looks (attestation-style signals), via IntegrityService.EvaluatePlayerDeviceTrust and Player.DeviceTrustLevel, so you can gate join or features.

Which platforms are supported at launch?

Staff: Android and Web first; iOS, consoles, and Windows called out for later expansion. Always confirm current docs.

Does Unknown mean the player is cheating?

No. Docs: Unknown means Roblox can’t tell — unsupported platform or error. You choose policy.

Can I read DeviceTrustLevel on the client?

You can read many properties locally, but staff warn against trusting client-side values for security — spoofable. Decide on the server.

Should I Kick everyone who isn’t Full?

Usually no. Pending, Unknown, and Standard will catch real players. Prefer soft gates and metrics first.

Does Device Trust stop all exploits?

No. It raises cost at the door. Weak server validation still loses the economy.

How does this relate to Web game testing?

Web clients and Device Trust Web behavior interact — hard Kick policies can erase Web play. Treat Web as its own policy row (check 7).

What should companies require?

Server-only enforcement, Unknown/Web written policies, metrics before Kick, economy Remotes still validated, signed ship receipt.

Is this the same as account verification (IsVerified)?

No. Device trust is about the device, not the account. Different signal.

Where do I paste a team summary?

Use the Discord-ready brief above.

When do we revisit the policy?

When Roblox expands platform coverage or your Web/Android mix shifts — calendar a quarterly re-read of the docs.

What if support says “Device Trust broke joins”?

Disable hard Kick via flag, pull metrics, check Pending/Unknown rates — don’t “fix” by kicking harder.

How long should we stay on log-only?

Until you have a stable histogram across peak hours and at least one weekday + one weekend sample for Web vs Android. For many indies that is 7–14 days of soft gates — not “ship Kick tomorrow because the announcement dropped.”

Can matchmaking alone replace Device Trust?

No. Matchmaking pools are a consumer of trust levels. Without Device Trust (or another signal) you are still sorting on weaker heuristics. Conversely, Device Trust without fair maps still feels bad — use both deliberately.

Should UGCs or private servers opt out?

Document it. Private VIP / friends-only places sometimes want looser join rules and stricter trade rules. Put that in check 4’s one-pager so VIP hosts are not surprised.

Does this change TextChatService migration work?

Orthogonal. Chat privacy cutovers (May 2027 lock list) are a different surface. You may gate chat features with trust levels, but do not conflate Device Trust with TextChat API migration tickets.

Related reading

• Improve Your Game Security with the Device Trust API (primary)
• Device trust docs
• Security and cheat mitigation tactics
• TextChatService May 2027 lock list
• IAM full release what-changed
• AnimatedImages EAP live Stop
• Roblox Studio guide
• 25 free Discord servers
• HTTP 403 help
• Game development courses
• Roblox Cube

Write the Unknown policy before the Kick. Measure before you ban. Device Trust hardens the door — it does not excuse a hollow house. When the next platform gains attestation support, re-run checks 4, 7, and 10 before you celebrate a wider Kick net.