How it works

Filters run on every request to your nexrbx.com/api/webhooks/p/… proxy before forwarding. When a webhook has filters attached, all active filters must pass. Blocked requests return HTTP 403 and appear in webhook analytics.

Filter types

API key required — caller must send a valid NEX developer API key for your account. Optionally restrict to specific keys.
IP allowlist — only listed client IP addresses are allowed.
Source allowlist — only listed sources (e.g. roblox) are allowed. Detected from JSON source, X-Nex-Source, or user-agent.
Content blocklist — block when the JSON body contains blocked words or regex patterns.

Create and attach

Dashboard → Filters → Create Filter
Choose a type and configure the rule
Attach to webhooks in the create form, or later via Webhooks → Settings → Request filters

Examples

Only your game server can hit the proxy. Pair with API keys.

Create filter: type API key required
Attach to webhook
Send key via header or JSON — see below

Accepted auth

Header: X-Nex-Api-Key
Header: Authorization Bearer
JSON: api_key / nex_api_key

Roblox POST with key

HttpService:PostAsync(url, body, Enum.HttpContentType.ApplicationJson, false, {
  ["X-Nex-Api-Key"] = "nex_dev_…",
})

Reject invite spam or blocked phrases before they reach Discord.

Filter config

Words: free robux
Words: discord.gg/
Pattern: discord\.gg\/\w+

Blocked request → 403

{ "message": "join discord.gg/abc123" }

Allow only traffic tagged as Roblox.

Project files

ServerScriptService/
- NexRobloxEvent.server.lua

Include source in payload

HttpService:JSONEncode({
  source = "roblox",
  event = "player_joined",
  userId = tostring(player.UserId),
})

Stacking with auto-delivery

Filters run first, then auto-delivery rules. A common production stack: API key filter → purchase trigger → grant or API key delivery → redeem or verify in-game.