Forem: Vxrpenter

Discord OAuth, hard to understand, easy to use

Vxrpenter — Sat, 21 Jun 2025 16:20:43 +0000

Introduction
What is OAuth
Using OAuth
- Creating the OAuth Link
- Creating a simple WebServer
- Making the api requests
Conclusion

Introduction

I once needed to connect users Discord accounts with their Steam accounts. So I just asked them to enter their SteamId and then connected them using a simple database table. I thought that was it, but then someone brought the fact to me, that people could enter someone else's SteamId to impersonate them and take actions in their account. So I tried finding a way to fix it and that lead me to my biggest coding nightmare, working with Discord OAuth.

What is even OAuth

Cloudflare defines OAuth as follows: "OAuth is a technical standard for authorizing users. It is a protocol for passing authorization from one service to another without sharing the actual user credentials, such as a username and password" [Source]

We can compile this down to the following statement, "OAuth allows us to access certain information without credential sharing". For Discord this allows us to get account connections, guilds (Discord servers) or even E-Mails without the user having to provide their password. It should be self explanatory why this is useful but to boil it down, it allows us to interact with certain user information in a safe and private manner.

Using OAuth

Let's look into OAuth from the problem described in the introduction. We need to connect a Discord UserId with a SteamId, so we need two different OAuth scopes. These are identify, which allows us to use the user/@me endpoint, for querying user profile information and the connections scope, which gives us access to the /users/@me/connections endpoint, which returns connections information.

So what steps do we need now, that we know what information we need to query?

Creating the OAuth link
Creating a simple WebServer for redirects
Making the Api requests

Creating the OAuth link

The OAuth link, is generated by Discord and given to the user, for them to authorize the data transfer. It is really simple to create one, although you have to take some things into account.

Firstly, navigate to the Discord Developer Portal, then click on your application and find the OAuth section. Here we need to add the redirect, that Discord will send the user to. In our case we will simply use a localhost:

Next, we'll select our scopes (identify and connections) in the URL generator:

And at last, just select the redirect you entered previously and your URL will be shown below:

When you provide a user with this link, they will be prompted with this popup. After clicking on authorize they will then be redirected to your page, allowing us to start using OAuth.

Creating a simple WebServer

Oauth requests from Discord work in the following way:

User authorizes through your OAuth link
Discord redirects them to your WebServer with an authorization code attached
You send a request to discord to get an authorization token
You query data using the token

It sounds really simple and it is really simple, but it took way to long for me to understand this, so let's go through it step by step. We firstly create a simple WebServer for our OAuth redirect:

embeddedServer(Netty, 8080) {
    routing { 
        get("discord/redirect/oauth") {

        }
    }
}.start(true)

After that, we just have to search for the authorization code in the request parameters and maybe add a small response text (this code is in the get... section):

call.respondText("The redirect was successful, you can close this page now")
val authorizationCode = call.request.queryParameters["code"]

Making the api requests

After receiving our authorization code, we still need to get the authorization token, to actually start querying user data. We'll start by creating a json decoder plus an Http-Client for our request:

val json = Json {
    ignoreUnknownKeys = true
}

val client = HttpClient(CIO) {
    install(ClientContentNegotiation) {
    (json)
        formData()
    }
}

Now we need a data class that our json decoder can use for the serialization process (for other languages, use the best json decoding manner available):

@Serializable
data class DiscordTokenResponse(
    @SerialName("access_token")
    val accessToken: String,
    @SerialName("token_type")
    val tokenType: String,
    @SerialName("expires_in")
    val expiresIn: Long,
    @SerialName("refresh_token")
    val refreshToken: String,
    @SerialName("scope")
    val scope: String
)

Then we'll create our request and send it using our created client:

val tokenCall = client.post("https://discord.com/api/oauth2/token") {
    setBody(FormDataContent(Parameters.build {
        append("client_id", clientId)
        append("client_secret", clientSecret)
        append("grant_type", "authorization_code")
        append("code", authorizationCode)
        append("redirect_uri", uri)
    }))
}

At last we'll check for the request's success and then serialize our json output:

if (!tokenCall.status.isSuccess()) return
val tokenResponse = json.decodeFromString<DiscordTokenResponse>(tokenCall.bodyAsText())

Now we have our lovely token. We can now use this token to firstly get our userId and a corresponding data class:

@Serializable
data class DiscordUser(
    val id: String,
    val username: String,
)

val userCall = client.get("https://discord.com/api/users/@me") {
    header("Authorization", "Bearer ${tokenResponse.accessToken}")
}

if (!userCall.status.isSuccess()) return
val discordUser = json.decodeFromString<DiscordUser>(userCall.bodyAsText())

Then we follow up with our connection request and the corresponding data class:

@Serializable
data class DiscordConnection(
    val id: String,
    val name: String,
    val type: String,
    @SerialName("friend_sync")
    val friendSync: Boolean,
    @SerialName("metadata_visibility")
    val metadataVisibility: Int,
    @SerialName("show_activity")
    val showActivity: Boolean,
    @SerialName("two_way_link")
    val twoWayLink: Boolean,
    val verified: Boolean,
    val visibility: Int
)

val connectionCall = client.get("https://discord.com/api/users/@me/connections") {
    header("Authorization", "Bearer ${tokenResponse.accessToken}")
}

if (!connectionCall.status.isSuccess()) return

val connections = json.decodeFromString<List<DiscordConnection>>(connectionCall.bodyAsText())

Now that we have our values, we can simply connect them, completing our little OAuth adventure.

Conclusion

Discord OAuth, or OAuth in general does take a bit to get used to, but isn't as complicated as I once thought. I had a lot of problems with it, when I first tried to use it and needed help by other developers to do so. But after a lot of time and stress I finally understood it. The thing I learned from this, you just have to try over and over until you succeed.

This was more of a tutorial article, hope that it was still somewhat entertaining and informational. The examples are in Kotlin, but the general structure can be applied to all languages.

Sources

The cover image was taken from discord's official branding page
Definition of OAuth was taken from this Cloudflair Article
Information from this German Wikipedia Article was also used for research
The Discord Developer Docs were used for the endpoint and OAuth information

What 1 year of Discord Bot Development taught me

Vxrpenter — Sat, 21 Jun 2025 14:24:52 +0000

Introduction
Replying and RestAction Failure
Always do extra work on Embeds
Use Configuration
Conclusion

Introduction

When starting to develop Discord bots, I knew nothing about it. I even had problems getting the bot online, because I didn't understand how token's worked. It took me a embarrassingly long time to understand some of the quirks and functions of the discord API, and me being relatively new to the coding space didn't help a bit. I want to share some of my experiences and a bit of corresponding advice with other developers, to lessen their suffering or for you to laugh at my issues xD.

Replying and RestAction failure

When working with any sort of event (buttons, modals etc.), you have to reply to it any form, be it a message, an edit, or just a defer. But often I did something like this:

api.listener<ButtonInteractionEvent> { event ->
    SomeLongExecutingFunction()
    event.reply_("A peculiar message").queue()
}

This always caused an ErrorResponseException, which then halted the whole event's process and broke several functions. It took me long to understand why this was happening until I read the error message which stated that "[t]his interaction took longer than 3 seconds to be acknowledged", which then brought me to the realization that what I was doing was stupid and redundant.

So after testing a bit and reading around 100 StackOverflow posts, I found the most simple solution to this was:

api.listener<ButtonInteractionEvent> { event ->
    event.deferReply(true).queue()
    SomeLongExecutingFunction()
    event.hook.send("A peculiar message").queue()
}

This simply prompts the user with a bot thinking message and gives the bot a longer time to wait before replying to a message. It's such a simple solution and makes me question my own IQ.

Always do extra work on Embeds

When firstly starting to work with Embeds, I did only the most minimal work, in styling them, as possible. I thought that it would look good either way, but they often turned out as something like this:

val embed = Embed {
    title = "Lorem ipsum dolor sit amet"
    description = " Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aliquam lacinia eget odio nec fringilla. Aliquam fringilla vulputate quam. Curabitur commodo nisl lorem, eget eleifend odio commodo quis. Vivamus non enim porttitor, ornare ex nec, pellentesque lectus. Integer mollis accumsan lacinia. Nam in libero egestas, lacinia nulla a, vehicula urna. Nullam."
}

After some time I decided to put in some extra work to make them look better, which taught me some good advice.

1‎.‎ ‎Some color can make a huge difference. It doesn't have to be the most vibrant color, but even a slight red tone, can make an Embed look so much better:

val embed = Embed {
    color = 0xE74D3C
    title = "Lorem ipsum dolor sit amet"
    description = " Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aliquam lacinia eget odio nec fringilla. Aliquam fringilla vulputate quam. Curabitur commodo nisl lorem, eget eleifend odio commodo quis. Vivamus non enim porttitor, ornare ex nec, pellentesque lectus. Integer mollis accumsan lacinia. Nam in libero egestas, lacinia nulla a, vehicula urna. Nullam."
}

2‎.‎ When a message is about a single user, or references them in a particular way, always try using mentions and thumbnails/author. It makes makes the message stand out more and gives it a personal vibe:

val embed = Embed {
    color = 0xE74D3C
    author {
        name = event.user.globalName
        iconUrl = event.user.avatarUrl
    }
    title = "Lorem ipsum dolor sit amet"
    description = " Lorem ipsum dolor sit amet, ${event.user.asMention}. Aliquam lacinia eget odio nec fringilla. Aliquam fringilla vulputate quam. Curabitur commodo nisl lorem, eget eleifend odio commodo quis. Vivamus non enim porttitor, ornare ex nec, pellentesque lectus. Integer mollis accumsan lacinia. Nam in libero egestas, lacinia nulla a, vehicula urna. Nullam."

}

Or the same thing with the bigger thumbnail:

val embed = Embed {
    color = 0xE74D3C
    thumbnail = event.user.avatarUrl
    title = "Lorem ipsum dolor sit amet"
    description = " Lorem ipsum dolor sit amet, ${event.user.asMention}. Aliquam lacinia eget odio nec fringilla. Aliquam fringilla vulputate quam. Curabitur commodo nisl lorem, eget eleifend odio commodo quis. Vivamus non enim porttitor, ornare ex nec, pellentesque lectus. Integer mollis accumsan lacinia. Nam in libero egestas, lacinia nulla a, vehicula urna. Nullam."

}

Use Configuration

This is a thing I realized fairly fast, but still took some time to really internalize. There are many values you need to enter into your bot e.g. token, secret, activity, messages, embed content etc. It is a bit of a hustle to make all of that configurable but it will pay off in the end. As an example look at these two snippets of code, which one looks cleaner?:

First the one without any configurable values (configurable meaning not editing the code itself but something like a config.yml that holds the values):

val api = light("mySuperSecretToken", enableCoroutines = true) {
    setActivity(Activity.of(ActivityType.PLAYING, "/help"))
}

And the second one with configuration:

val api = light(config.settings.token, enableCoroutines = true) {
    setActivity(Activity.of(ActivityType.PLAYING.takeIf {
        !enumContains<ActivityType>(config.settings.activityType)
    } ?: ActivityType.valueOf(config.settings.activityType), config.settings.activityContent))
}

At first glance, the second one seems more complicated but that just comes from the handling of probable miss-configurations, by providing a base value for the activity type that is used when the config value is missing or configured incorrectly.

But this provides so much value to normal users, or even for yourself as the developer:

It is easy to change these values whenever you like.
When you are working with longer compile times (e.g. Docker Images), it can make your work so much faster
You don't have your token in the compiled program
You are able to easily share the project/make it open source without having to search through your code for secret values
...

Then we have an example for a normal text reply, either you use a hard-coded solution like this:

event.reply_("Lorem ipsum dolor sit amet, consectetur adipiscing elit. Morbi eget. ").queue()

Or you can just create a special translation configuration that stores all of these texts:

event.reply_(translation.lipsum.textPlaceholder).queue()

It even opens up the possible implementation of multi language support, by just creating multiple translation files e.g. en_US, en_UK, de_DE etc. and then just using a single Serializer to convert all of these files to the same usable format.

Conclusion

These are just some of the things I learned while developing Discord bots, but they are the most significant ones. I hope that you somehow enjoyed reading this article and hopefully were able to learn something from it. As this is my first article ever, I would appreciate some constructive criticism (btw. english is not my mother tongue so I'm sorry for any language mistakes).

If you want to check out some of my work, you can look at my GitHub or the project were I implemented all of this/learned it:

Vxrpenter / SCPToolsBot

⚡ A discord bot application for usage on SCP: Secret Laboratory servers

SCPToolsBot

What is ScpToolsBot

ScpTools Bot is an application to enhance your Scp Secret Laboratory server by providing quality-of-life features in combination with moderation and team management tools It also integrates with plugins like cedmod to build on already existing infrastructure and to use features they offer.

For more information check out the wiki or join the discord:

What Features are included

Feature	What is this
Fully customizable translation	All text can be changed to anything you can imagine, there are even color codes and other utility functions for even more customizability
Configuration options	Many features can be changed to personal liking, e.g. disabling a certain part of it or enabling something else that is not active by default
Status bot cluster	A cluster of bots that show the player count of your server. They also send connection messages to a channel that was configured by the sysadmin, that show

…

View on GitHub

Sources:

The cover image was taken from discord's official branding page
The placeholder text has been taken from the Lipsum page
The code examples were written in kotlin using the JDA and jda-jtx libraries

Forem: Vxrpenter

Discord OAuth, hard to understand, easy to use

Table Of Contents

Introduction

What is even OAuth

Using OAuth

Creating the OAuth link

Creating a simple WebServer

Making the api requests

Conclusion

Sources

What 1 year of Discord Bot Development taught me

Table Of Contents

Introduction

Replying and RestAction failure

Always do extra work on Embeds

Use Configuration

Conclusion

Vxrpenter / SCPToolsBot

⚡ A discord bot application for usage on SCP: Secret Laboratory servers

SCPToolsBot

What is ScpToolsBot

What Features are included

Sources: