Roblox Scripting Guide: Scripts, APIs & RemoteEvents

Roblox uses a dialect of Lua called Luau to power everything from character movement to in-game economies. Scripts run in different contexts depending on where they live and what type they are — understanding that distinction is the single most important thing you can learn as a Roblox developer. This guide covers the three script types, the APIs you will use most often, and patterns for keeping your game secure and performant.

Script Types

Roblox has three kinds of scripts, each serving a distinct role in your game’s architecture.

Server Scripts
Local Scripts
Module Scripts

A Script (sometimes called a server script) runs on Roblox’s servers and has authority over the game world. It can modify the workspace, manage player data, handle purchases, and communicate with clients via RemoteEvents and RemoteFunctions. Server scripts are placed in ServerScriptService or directly in the workspace.

-- ServerScriptService > GameManager (Script)
local Players = game:GetService("Players")

Players.PlayerAdded:Connect(function(player)
    print(player.Name .. " has joined the server.")

    -- Give the player a starting resource folder
    local resources = Instance.new("Folder")
    resources.Name = "Resources"
    resources.Parent = player

    local coins = Instance.new("IntValue")
    coins.Name = "Coins"
    coins.Value = 100
    coins.Parent = resources
end)

Creating a part from a server script:

-- Spawns a glowing part at the centre of the map
local part = Instance.new("Part")
part.Name = "GlowPart"
part.Size = Vector3.new(4, 4, 4)
part.Position = Vector3.new(0, 10, 0)
part.BrickColor = BrickColor.new("Bright blue")
part.Material = Enum.Material.Neon
part.Anchored = true
part.Parent = workspace

A LocalScript runs on the individual player’s client (their device). Use it for UI interactions, camera control, player input, and visual effects that do not need to be shared with other players. LocalScripts are placed in StarterPlayerScripts, StarterCharacterScripts, or StarterGui.

-- StarterPlayerScripts > InputHandler (LocalScript)
local UserInputService = game:GetService("UserInputService")
local Players = game:GetService("Players")
local localPlayer = Players.LocalPlayer

UserInputService.InputBegan:Connect(function(input, gameProcessed)
    if gameProcessed then return end

    if input.KeyCode == Enum.KeyCode.E then
        print("You pressed E — triggering interaction.")
        -- Fire a RemoteEvent to the server here
    end
end)

Never trust data sent from a LocalScript. A client can be modified by exploiters, so always validate important actions on the server side.

A ModuleScript is a reusable code library that returns a table of functions or values. Both Scripts and LocalScripts can require() a ModuleScript, making it the right place for shared logic like utility functions, configuration constants, or data definitions.

-- ReplicatedStorage > Utils (ModuleScript)
local Utils = {}

function Utils.clamp(value, min, max)
    return math.max(min, math.min(max, value))
end

function Utils.round(value, decimals)
    local factor = 10 ^ (decimals or 0)
    return math.floor(value * factor + 0.5) / factor
end

return Utils

-- Requiring the ModuleScript from any other script
local Utils = require(game.ReplicatedStorage.Utils)

print(Utils.clamp(150, 0, 100))  -- Output: 100
print(Utils.round(3.14159, 2))   -- Output: 3.14

Key Roblox APIs

These services are the ones you will reach for in almost every project.

Service	What it does
`game`	The root DataModel — the top of the entire hierarchy
`workspace`	Contains all physical objects in the 3D world
`Players`	Access connected players and their characters
`ReplicatedStorage`	Store assets and ModuleScripts accessible by both server and client
`ServerStorage`	Server-only asset storage (clients cannot access this)
`TweenService`	Animate properties of objects smoothly
`RunService`	Hook into frame-by-frame update loops
`DataStoreService`	Persist player data across sessions

RemoteEvents and RemoteFunctions

RemoteEvents and RemoteFunctions let the server and client talk to each other. Place them in ReplicatedStorage so both sides can reference them. RemoteEvent — fire and forget (no return value needed):

-- SERVER: ServerScriptService > CoinHandler (Script)
local ReplicatedStorage = game:GetService("ReplicatedStorage")
local Players = game:GetService("Players")

local awardCoinsEvent = ReplicatedStorage:WaitForChild("AwardCoins")

awardCoinsEvent.OnServerEvent:Connect(function(player, amount)
    -- Always validate on the server!
    if typeof(amount) ~= "number" or amount <= 0 or amount > 500 then
        return -- Reject suspicious requests
    end

    local coins = player.Resources:FindFirstChild("Coins")
    if coins then
        coins.Value = coins.Value + amount
        print("Awarded " .. amount .. " coins to " .. player.Name)
    end
end)

-- CLIENT: StarterPlayerScripts > CollectHandler (LocalScript)
local ReplicatedStorage = game:GetService("ReplicatedStorage")

local awardCoinsEvent = ReplicatedStorage:WaitForChild("AwardCoins")

-- Fire when the player collects a coin pickup (example trigger)
local function onCoinCollected(coinAmount)
    awardCoinsEvent:FireServer(coinAmount)
end

onCoinCollected(50)

Studio test mode vs. live game: When you playtest in Roblox Studio using the Play button, your scripts run locally and some services (like DataStoreService) are in a sandboxed mode. Always use Team Test or publish to a test place to verify server–client communication behaves exactly as it will in production.

FilteringEnabled and Server Security

FilteringEnabled is always on in modern Roblox. This means changes made on a client are not automatically replicated to the server or other players. Any action that should affect the shared game world — awarding items, modifying stats, spawning objects — must be handled by a server Script, not a LocalScript.This is a core security model. If you let clients directly modify server state, exploiters can abuse it to give themselves unlimited currency, kill other players, or break your game. Always route important actions through a RemoteEvent and validate every incoming value on the server.

Keep Learning

Lua Basics

Brush up on variables, tables, loops, and other Lua fundamentals that underpin every Roblox script.

Debugging Tips

Learn how to interpret Luau errors from the Output window and fix broken scripts quickly.

Get Started

Scripting Guides

Working With Us

Support

Roblox Scripting Guide: Scripts, APIs & RemoteEvents

Script Types

Key Roblox APIs

RemoteEvents and RemoteFunctions

FilteringEnabled and Server Security

Keep Learning

Lua Basics

Debugging Tips

​Script Types

​Key Roblox APIs

​RemoteEvents and RemoteFunctions

​FilteringEnabled and Server Security

​Keep Learning

Lua Basics

Debugging Tips

Script Types

Key Roblox APIs

RemoteEvents and RemoteFunctions

FilteringEnabled and Server Security

Keep Learning