guider

Discord

Agent draftUpdated 29 Oct 2026docs.discord.com

Standard Discord user OAuth requires straightforward app registration and Composio configuration. Ordinary scopes have no documented launch review queue; restricted scopes, large bot deployments, and Discovery have separate approval requirements.

No review needed

Connect real users through standard OAuth scopes without a documented tester allowlist. User OAuth does not grant unrestricted access to messages or permission to automate ordinary accounts.

Your timeAbout 30 minutesestimateReview waitNone for ordinary scopesestimate
  • A public privacy policy linked from the Developer Portal and your application
  • Discord approval for restricted OAuth scopes
  • Annual privileged-intent renewal after review approval [4]
  • Identity and application verification before enabling Discovery [5]
  1. 01

    Create the Discord application [2]

    You
    Open Developer Portal
    Show me how
    1. Click New Application.
    2. Enter a name, then click Create.
    3. Update the description and icon in General Information.
  2. 02

    Choose supported OAuth scopes [1]

    Agent

    Match scopes to the Composio tools you need. Start with identify; add email, guilds, connections, or guilds.members.read only when needed. Ordinary OAuth does not provide general message access.

    Discord approval gates applications.builds.upload, dm_channels.read, identify.premium, rpc, rpc.activities.write, rpc.notifications.read, rpc.voice.read, rpc.voice.write, and voice. relationships.read requires Social SDK access; activities.read and activities.write are unavailable.

    Authorization fails for restricted scopes. Remove restricted scopes or obtain Discord approval. Partner-only scopes require contacting your Discord account representative.
    Show me how
    1. Map each required tool to its documented OAuth scope.
    2. Remove unused scopes from the Composio auth configuration.
    3. Request Discord access before including restricted scopes.
  3. 03

    Register the Composio redirect [1]

    You
    Open your application's OAuth2 settings
    Redirect URL to paste
    https://backend.composio.dev/api/v3/toolkits/auth/callback
    Discord rejects the redirect URI. Register the exact callback URL in Discord and set the identical Redirect URI in Composio.
    Show me how
    1. Select your application, then open OAuth2.
    2. Under Redirects, click Add Redirect.
    3. Paste the callback URL, then click Save Changes.
  4. 04

    Save credentials in Composio [7]

    You
    Open Discord OAuth2 settings
    Client IDPaste into your Composio auth config, never into a chat
    Client SecretPaste into your Composio auth config, never into a chat

    Use the OAuth Client Secret, not the bot token. Set Composio's Redirect URI to the callback registered above.

    Create the Composio auth config
    Show me how
    1. Copy Client ID and Client Secret from Discord's OAuth2 page.
    2. Click Create Auth Config and select Discord.
    3. Select OAuth2 and enable Use your own developer credentials.
    4. Enter credentials, scopes, and Redirect URI, then click Create.
  5. 05

    Publish your privacy policy [6]

    You

    Publish a privacy policy covering collection, Composio and AI processing, retention, sharing, and deletion requests. Add its public URL in the Developer Portal and make it accessible from your application.

    Update application information
    Show me how
    1. Publish your privacy policy at a publicly accessible URL.
    2. Open General Information and fill Privacy Policy URL.
    3. Save changes and link the policy from your application.
  6. 06

    Test a real user connection estimate

    Agent

    Attach the custom auth config to your Composio session and generate a connection link. Have the user authorize Discord, then test the required tools and reconnection behavior.

    Read token expiry from expires_in rather than assuming permanence. Discord's example returns 604800 seconds, or seven days, with a refresh token; this is an example rather than a guaranteed lifetime.

    Message tools exceed OAuth access. Use supported bot or webhook APIs for the required actions. Adding OAuth scopes does not grant arbitrary user-account automation.
    Show me how
    1. Generate a Composio connection link using the custom auth config.
    2. Have a user complete Discord authorization.
    3. Run the required tools against the connected account.
    4. Check refreshed access and revoked-access recovery.
  7. 07

    Handle conditional Discord approvals [3]

    You

    For user OAuth with ordinary scopes, proceed with your connection flow. If you also install a bot, complete App Verification before scaling past 100 servers; team-owner identity verification uses Stripe.

    Guild Members, Presence, and Message Content privileged intents require review at 10,000 unique reachable users across installed servers. Apply within 90 days of notification and reapply annually; timely submissions retain access during review.

    Discovery is a separate opt-in after identity and application verification. Use it when you want App Directory and App Launcher distribution.

    Check application approval requirements
    Bot cannot join additional servers. Complete App Verification before scaling past 100 servers. Privileged-intent review is a separate process.
    Show me how
    1. Open App Verification if your bot needs more than 100 servers.
    2. Complete the checklist and click Verify App.
    3. Submit privileged-intent requests when the Developer Portal notifies you.
    4. Open Discovery → Discovery Status if you want directory distribution.

Not sure yet

  • ?Whether Discord applies an unpublished user cap to ordinary OAuth authorizations
  • ?Whether a separate user-OAuth development mode exists; none is documented
  • ?How long restricted-scope, App Verification, or privileged-intent approval takes
  • ?Whether this integration requires domain verification or an external security assessment
  • ?Whether refresh tokens have a fixed maximum lifetime

Sources