IAA BOT FAQ
Answers to common website, Netlify, OAuth, API security, guild, configuration, and hosting questions.
Questions#
Does IAA BOT work without a website?
Not as a complete system. The companion website/backend provides OAuth, authorization, staff access, records, and API workflows.
Can I use a normal static website?
No. Static files alone cannot securely exchange OAuth codes, store secrets, persist records, or validate signed API requests.
Can I host the website on Netlify?
Yes, when server-side features such as Netlify Functions implement the required OAuth and API behavior.
What are Netlify Functions?
Server-side handlers deployed with a Netlify site. They can process OAuth callbacks and protected API requests without exposing secrets to the browser.
Why does IAA BOT need Discord OAuth?
It associates a Discord identity and granted access with an authorization record controlled by the website backend.
Is the bot token the OAuth client secret?
No. They are separate credentials with different purposes.
Is the API key the signing secret?
No. Use separate random values.
Where should OAuth tokens and client secret be stored?
In protected server-side storage on the website backend, never browser localStorage or frontend JavaScript.
What is a nonce?
A unique single-use request value that lets the backend reject replayed signed requests.
Why HTTPS?
HTTPS protects OAuth codes, sessions, API traffic, and users from network interception.
Can I change the default URLs?
Yes, through environment variables when the compatible backend implements equivalent behavior.
Can the IAA and main guilds differ?
Yes. Configure IAA_GUILD_ID and MAIN_GUILD_ID separately.
What is buyer_config.json?
The local mapping of Discord role IDs and workflow channel IDs.
Why is a role set to 0?
Zero represents an unconfigured local mapping where supported.
What is iaa_workflows.sqlite3?
Local workflow state used by the bot; the website database remains primary for strict synchronization.
Can Sparked Host run the bot while Netlify runs the website?
Yes. Components may be hosted separately as long as the bot can securely reach the HTTPS backend.