Discord OAuth & bot permissions
What RyphexGuard asks Discord for, why the permission exists, and what that permission does not give RyphexGuard.
OAuth sign-in happens on Discord. If a page pretending to be RyphexGuard asks you to type your Discord password directly into RyphexGuard, do not continue.
identify
Used to read the Discord user ID, username and avatar needed to identify who completed verification.
email
Used only in workflows that actually request a Discord account email for account/support-related purposes. RyphexGuard should not expose this as a general member-search field to server owners.
guilds.join
This is the recovery-sensitive scope. It allows an authorized application/bot to add an eligible previously-authorized Discord account to a target guild through Discord's API.
- The authorization must still be valid.
- The bot/application must have access to the target server.
- The target operation still depends on Discord API rules and availability.
- A stored authorization does not guarantee that a member can be joined forever.
Core bot permission: Manage Roles
RyphexGuard's core verification role-assignment flow checks for Manage Roles. This lets the connected bot assign the configured verification role when Discord's role hierarchy permits it.
Administrator is not required for the core role-assignment check. Avoid granting Administrator simply because it is convenient. Grant only the permissions required by the features you actually use.
Feature-specific bot permissions
Some optional features can need more access. For example, an AI server-building feature that creates categories, channels or roles needs Discord permissions for those operations. Those permissions should be granted because you intentionally enabled that feature—not because core verification requires them.
Server ownership & dashboard access
RyphexGuard uses Discord/server ownership and connected-bot checks to determine which servers an account can manage through protected dashboard workflows. Team members should only receive the server-scoped dashboard permissions explicitly granted by the workspace owner.
How to revoke access
- Discord account authorizationRemove the authorized app from Discord's Authorized Apps settings when you no longer want that OAuth authorization active.
- Bot accessRemove the bot from a Discord server or rotate its token in the Discord Developer Portal if the credential is exposed.
- RyphexGuard accountUse account deletion/support for RyphexGuard-held account data where applicable.
What RyphexGuard cannot do through these scopes
Read your Discord passwordOAuth does not expose it to RyphexGuard.
Read private DMs through these scopesThe documented scopes are not a private-message reading permission.
Bypass Discord rulesDiscord API restrictions, revoked authorization and permission hierarchy still apply.
Something does not match this document?
If an authorization screen or bot invite asks for more access than expected, stop and verify the feature you are enabling. Report a suspicious or excessive permission request through responsible disclosure.
