IAA BOT
IAA Website Developer Requirements
Requirements a web developer must implement for the IAA BOT companion website and backend.
Server-side capability is required#
A basic HTML or static-only website cannot securely exchange OAuth codes, store OAuth credentials, enforce staff permissions, persist cases, validate HMAC signatures, prevent nonce replay, or protect API keys. The complete system needs server-side code.
Suitable architectures#
| Architecture | Use |
|---|---|
| Netlify Functions | Server-side API and OAuth handlers deployed with a Netlify site. |
| Next.js server routes | Full-stack application with protected server handlers. |
| Node.js or Express backend | Dedicated API and website service. |
| Other secure API hosting | Any environment that supports HTTPS, secrets, persistence, and the required contract. |
Developer handoff checklist#
- Use HTTPS for every public route.
- Implement server-side Discord OAuth2 code exchange.
- Store OAuth tokens and client secret in protected server storage.
- Implement authorization, staff, permissions, blacklist, case, audit, and workflow routes.
- Validate bearer API key and HMAC request signature.
- Enforce timestamp tolerance and nonce replay prevention.
- Provide authorization revocation and account-data deletion.
- Keep audit and security logs without logging secrets.
Default website paths#
| Path | Purpose |
|---|---|
| /server/backend/intel/iaa | Staff portal. |
| /server/backend/intel/iaa/staffroles | Staff-role management. |
| /server/backend/intel/iaa/public/authorize | Public authorization entry. |
| /api/server/backend/intel/iaa | Default API base. |