What is the difference between a Bot Token and an OAuth2 Access Token for Discord API?

A Bot Token is a static credential for a bot application, granting it direct API access with defined permissions. An OAuth2 Access Token is a temporary token obtained by a user-facing application after a user grants it permission to act on their behalf, typically for accessing user-specific data.

How do I get a Bot Token for my Discord bot?

You obtain a Bot Token by creating an application in the Discord Developer Portal, navigating to the 'Bot' section, adding a bot, and then resetting the token. It's crucial to copy the token immediately as it's only shown once.

What is the purpose of the Client ID and Client Secret in Discord OAuth2?

The Client ID publicly identifies your application during the OAuth2 flow. The Client Secret is a confidential key used by your application's backend server to securely exchange an authorization code for an access token with Discord's API.

Are Discord API tokens permanent?

Bot Tokens are persistent until they are manually revoked or regenerated. OAuth2 Access Tokens are short-lived (typically hours), but they can be refreshed using a longer-lived Refresh Token without requiring the user to re-authorize.

Why should I use HTTPS for my OAuth2 redirect URIs?

Using HTTPS for redirect URIs encrypts the communication, protecting the authorization code from interception during the redirect process. This prevents man-in-the-middle attacks and ensures the integrity of the OAuth2 flow.

What are scopes in Discord OAuth2?

Scopes define the specific permissions an application requests from a user's Discord account. Examples include 'identify' (access user's Discord ID and username) or 'guilds' (access list of Discord servers the user is in). Applications should only request necessary scopes.

What is the 'state' parameter in OAuth2 and why is it important?

The 'state' parameter is an opaque, unique value passed in the OAuth2 authorization request. It is returned unmodified in the callback and is crucial for preventing Cross-Site Request Forgery (CSRF) attacks by ensuring the response corresponds to a specific request made by your application.

Discord API Authentication: Methods, Credentials, and Security (2026)

Authentication overview

Discord API authentication establishes secure, authorized access for applications to interact with Discord's services. The specific authentication method depends on the nature of the application: whether it is a bot operating on a server or a user-facing application requesting access to a user's Discord account. Both approaches are managed through the Discord Developer Portal, where applications are registered and credentials obtained. Understanding the distinction between bot authentication and user authentication is fundamental for proper API integration and adherence to security protocols.

For programmatic interactions, Discord bots utilize a unique token, often referred to as a Bot Token. This token grants the bot direct access to the API with permissions defined during its setup. For applications that require access to a user's Discord account — such as retrieving profile information or acting on a user's behalf — the Discord API implements the industry-standard OAuth 2.0 framework. This mechanism allows users to grant third-party applications limited access to their data without sharing their Discord credentials directly. The OAuth 2.0 specification, detailed in RFC 6749, defines the roles and interactions involved in delegated authorization.

Supported authentication methods

The Discord API supports two primary authentication methods, each designed for distinct use cases:

Bot Tokens: Used for Discord bots. These tokens are essentially API keys for your bot application, granting it the permissions configured in the Discord Developer Portal. Bot Tokens are long-lived and provide direct access to the bot's capabilities and server interactions. They are included in the Authorization header of API requests, prefixed with Bot.
OAuth2: Used for applications that need to interact with a user's Discord account. OAuth2 enables delegated authorization, where a user grants an application specific permissions (scopes) to access their data or perform actions on their behalf. This process involves exchanging an authorization code for an access token and a refresh token. The access token is short-lived and used in API requests, prefixed with Bearer. The refresh token is used to obtain new access tokens without requiring the user to re-authorize.

The following table summarizes the key characteristics of each method:

Method	When to Use	Security Level	Token Type	Token Expiration
Bot Token	Programmatic access for Discord bots	High (if kept secret)	Static token	Persistent (until revoked)
OAuth2	User-granted access for third-party applications	High (with proper implementation)	Access Token, Refresh Token	Access (short-lived), Refresh (long-lived)

Getting your credentials

To authenticate with the Discord API, you must first register an application in the Discord Developer Portal. The process for obtaining credentials varies depending on whether you are creating a bot or an OAuth2 application.

For Bot Tokens:

Navigate to the Discord Developer Portal.
Click on 'Applications' and then 'New Application'.
Give your application a name and create it.
In the left sidebar, go to the 'Bot' section.
Click 'Add Bot' and confirm.
Under 'Token', click 'Reset Token' to generate a new Bot Token. Copy this token immediately; it will not be shown again.
Configure your bot's public/private status and Gateway Intents as required.

This token is your bot's secret key and grants full access to its capabilities. Treat it with the same care as a password.

For OAuth2 Credentials:

Navigate to the Discord Developer Portal.
Click on 'Applications' and then 'New Application' (or select an existing one).
In the left sidebar, go to the 'OAuth2' section.
Note your Client ID and Client Secret. The Client Secret is a confidential key used in backend server-to-server communication during the OAuth2 flow.
Add 'Redirects' URLs. These are the URIs to which Discord will redirect the user's browser after they authorize your application. Ensure these URLs are secure (HTTPS) and match the exact URLs in your application's OAuth2 flow.
In the 'General Information' section, ensure your application has a suitable icon and description, which will be visible to users during the authorization process.

The Client ID is public and identifies your application, while the Client Secret must be kept confidential.

Authenticated request example

Authenticating with the Discord API involves including your token in the Authorization header of your HTTP requests. The prefix for the token depends on the authentication method used.

Using a Bot Token:

For bot-related API calls, prefix your Bot Token with Bot.

GET https://discord.com/api/v10/users/@me
Authorization: Bot YOUR_BOT_TOKEN_HERE
User-Agent: YourBotName (https://yourwebsite.com, v1.0)

This example retrieves information about the bot user itself. Replace YOUR_BOT_TOKEN_HERE with your actual Bot Token.

Using an OAuth2 Access Token:

For user-related API calls after a successful OAuth2 flow, prefix your Access Token with Bearer.

GET https://discord.com/api/v10/users/@me
Authorization: Bearer YOUR_ACCESS_TOKEN_HERE
User-Agent: YourApplicationName (https://yourwebsite.com, v1.0)

This example retrieves information about the authenticated user. Replace YOUR_ACCESS_TOKEN_HERE with the access token obtained through the OAuth2 authorization code grant flow. Discord provides comprehensive API reference documentation for various endpoints and their required permissions.

Security best practices

Secure authentication is crucial for protecting both your application and Discord users. Adhering to these best practices will minimize vulnerabilities:

Treat Bot Tokens as confidential: Never expose your Bot Token in client-side code, public repositories, or unsecured environments. Store it securely using environment variables or a secrets management service. If compromised, immediately regenerate the token in the Discord Developer Portal.
Protect your OAuth2 Client Secret: Similar to Bot Tokens, the Client Secret should never be exposed client-side. It is used only for server-to-server communication when exchanging an authorization code for an access token.
Use HTTPS for all redirects: Ensure all OAuth2 redirect URIs use HTTPS. This encrypts the communication and prevents man-in-the-middle attacks from intercepting authorization codes.
Validate redirect URIs: Always configure explicit and exact redirect URIs in the Discord Developer Portal. Do not use wildcard URIs. This prevents malicious actors from redirecting users to fake sites.
Implement OAuth2 state parameter: Use the state parameter in your OAuth2 authorization requests to prevent Cross-Site Request Forgery (CSRF) attacks. This parameter should be a unique, unguessable value generated by your application and verified upon redirection.
Request minimal scopes: Only request the necessary OAuth2 scopes (permissions) that your application requires. Requesting excessive permissions can raise user suspicion and increase the impact of a potential breach.
Securely store Refresh Tokens: If your application uses refresh tokens for long-term access, store them securely in an encrypted database or vault. Revoke refresh tokens if there's any suspicion of compromise.
Implement proper error handling: Handle authentication errors gracefully and provide informative messages without revealing sensitive system details.
Regularly review audit logs: Monitor your application's activity and audit logs in the Discord Developer Portal for any suspicious authentication attempts or unauthorized access.
Keep dependencies updated: Ensure any Discord API libraries (e.g., discord.js, discord.py, discordgo) and your application's underlying frameworks are kept up-to-date to benefit from the latest security patches and best practices. Developers are encouraged to consult the official Discord API documentation for the most current security recommendations.