Title: Bug: “App Behavior Analysis” strictly requires sign-in/sign-out RASP scripts for apps with authentication disabled
Description: While preparing an application for publication, a logical error occurs during the automated testing stage. The testing tool requires RASP scripts to validate the sign-in/sign-out flow. This error persists even when the developer has explicitly indicated in the app profile settings that the application does not support user sign-in. Fellow developers in the official Roku Slack community have also pointed out this issue, noting that it is illogical to require validation scripts for features that do not exist within the app.
Steps to Reproduce:
Navigate to the “Can users sign in to your app?” section in the app profile settings.
Select the “No” option.
Go to the “Package & testing” section.
Wait for the “App Behavior Analysis” process to execute.
Actual Behavior:
The “App Behavior Analysis” check fails and displays a red exclamation mark icon.
A “Test information” modal appears with error details.
The specific error message reads: “Required RASP scripts for sign-in/sign-out flow not provided”.
Expected Behavior:
The “App Behavior Analysis” process should account for the application’s profile settings.
If user authentication is disabled, the system should bypass the RASP script validation for the sign-in/sign-out flow and successfully pass the behavior analysis.
I ticked the box indicating that the app requires login, added RASP scripts (not empty ones), filled in the test user section, and ran the Channel Behaviour Analysis, but it was clear that they had failed.
After that, I ticked the box indicating that the application does not require login. However, it still asks me for RASP scripts, but I have nowhere to upload them.
I see – I didn’t connect that the UI disabled upload of scripts for those parts when you said the app didn’t need them. I’ve filed an internal issue to check this out.
@roku_employees any update on this bug. We have an app with no login requirement we use pin code pairing and clicked no on the Can users sign in no RASP required. but your asking for one?
Same issue here. Channel "Cortex Player" (ID 874042), pending version PVMRCQ (v1.2.1). App profile has "Can users
sign in to your app?" = No (no account at all: it is a media player for the user's own list). Static Analysis passes;
App Behavior Analysis fails all 8 tests with "Required RASP scripts for sign-in/sign-out flow not provided", and the
dashboard offers no script upload because sign-in is disabled. Re-uploading the package did not clear it and
"Schedule publish" stays disabled. The same configuration passed ABA in July 2026 (v1.0.8, published July 16).
Support ticket opened as well.
I raised a similar issue on the 19th of February with Partner Success.
Static analysis was claiming that my app featured authentication, when it did not. But because SA had decided that it did, I had to either remove the non-existent feature or tick a box to confirm that the app had a feature that it did not have.
As this was blocking the release of an important update to an app that was already live (and which had not had this problem during its SA run), I tried ticking the box to see if that would allow me to progress further. It didn’t, because it then insisted that I upload RASP scripts that would allow the non-existent authentication feature to be tested.
I emailed Partner Success but of course they were no help at all. They were more interested in telling me I was the only person who had reported the issue than in helping with the problem that I was showing them with screenshots. This despite me pointing out someone else had reported the same thing on the developer Slack channel.
I got around what would otherwise have been a release blocker from Roku by uploading a couple of nonsense RASP scripts that don’t do anything at all. Their presence alone seemed to be enough to satisfy the check, and I was then able to schedule a release.
I’m pretty shocked though to see this thread on here a full 8 months later, and still no fix.
If Roku’s going to insist on implementing new validation steps then it needs to make sure the validation works. And when they’re reported as not working (complete with screenshots), they need to be investigated and fixed - not left for literally months on end to block more developers.
