IAA BOT
IAA BOT Discord OAuth2
Configure Discord OAuth2 and keep bot, OAuth, API, and signing credentials separate.
Do not confuse the credentials#
| Credential | Purpose | Storage |
|---|---|---|
| Discord bot token | Signs the bot process in to Discord | Bot server only. |
| Discord Application ID | Public identifier for bot and OAuth application | May appear in public authorization URLs. |
| Discord OAuth client secret | Server credential for OAuth code exchange | Website backend only. |
| OAuth access token | Represents a user’s granted Discord access | Encrypted or protected backend storage. |
| IAA API key | Bearer credential for bot-to-backend requests | Bot and backend server environments. |
| IAA signing secret | HMAC key for request integrity | Bot and backend server environments; separate from API key. |
OAuth configuration#
- Add the exact HTTPS callback URL in the Discord Developer Portal OAuth2 settings.
- The website sends the user to Discord authorization with the required scopes and a protected state value.
- Discord redirects the user to the server-controlled callback with a short-lived code.
- The backend validates state and exchanges the code using the client secret server-side.
- The backend associates the authenticated Discord user ID with the authorization record.
- Store refresh tokens securely only if continued access requires them.
- Provide revocation and account-data deletion behavior.