The developer portal

Applications, at the top of this site, is where you keep your bots. It is the same set of pages as Settings → Developers in the app: what you change in one is there in the other.

Signing in

The portal never asks for your password. Sign in sends you to the app, where you are signed in already; the app asks you once, and sends you back here with a code that works once, for two minutes.

What the portal may do once you are signed in:

The sign-in lasts a week on that browser, in a cookie the page's own script cannot read. Revoking the device you signed in from, or signing out everywhere, signs the portal out as well. Sign out at the top right ends it at once.

Applications

An application is the one thing you make here: its bot, its commands, its sign-in, its webhook and its Rich Presence all belong to it, and its id is its bot's. Each is a row: its name, whether its bot has ever signed in, and how many tokens it has. New application makes one. Applications whose team you are on are listed beside your own.

Open one for its pages:

• General: its application ID (its bot's account id, which an invite link names as client_id), name, summary, description, tags and support address.
• Installation: whether it is installed to servers, to people or both, and its invite link, built from the permissions its role should be offered.
• Sign-in: Sign in with ILLEST: its redirect addresses, its secret, and a sign-in link.
• Bot: whether anybody may add it or only you, what any of its tokens may attempt (its scopes), and its tokens.
• Commands: the slash commands and context menus it has registered, globally and per server.
• Webhooks: an address of yours told, signed, when somebody adds it or takes it back. See Application events.
• Rich Presence: what a game or tool shows on its player's profile.
• Team: who else may work on it. Read-only members look; developers handle tokens, secrets and endpoints; admins everything else; only the owner deletes it or hands it on.
• Activity: every change to it, who made it and when. Never a token or a secret itself.

Deleting an application, handing it on, making a bot token and making a new sign-in secret each ask for a fresh code from your authenticator first.

Tokens

A token is shown once, when it is made. Keep it where you keep passwords: anybody holding it can sign in as the bot. A bot may hold several, so you can roll one over: make the new one, move your code to it, then revoke the old.

Revoking a bot's last live token leaves it unable to sign in until it has another. The portal asks before it does that.

Adding a bot to a server

Copy the invite link from Installation and open it in the app. You choose a server you manage, untick any permission you would rather not give, and press Authorize. Nobody can give a permission they do not hold themselves, and a private bot can be added by its owner only.