Grow your server.
Stay in voice 24/7.

Step 1 — Create a Discord Application

1. Go to the Discord Developer Portal.
2. Click New Application and name it MioMembers.
3. Open OAuth2 → General and copy your Client ID and Client Secret.
4. Add a redirect URL: http://localhost:3000/auth/discord/callback (use your production domain in prod).

Step 2 — Configure OAuth2 scopes

For login only, request these scopes:

• identify — username, avatar, user ID
• email — optional, for receipts
• guilds — optional, list servers the user manages

Authorization URL pattern:

https://discord.com/api/oauth2/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &response_type=code
  &scope=identify%20email

Step 3 — Backend token exchange (Node.js example)

After Discord redirects with a ?code=..., exchange it server-side:

// POST https://discord.com/api/oauth2/token
const params = new URLSearchParams({
  client_id: process.env.DISCORD_CLIENT_ID,
  client_secret: process.env.DISCORD_CLIENT_SECRET,
  grant_type: 'authorization_code',
  code: req.query.code,
  redirect_uri: process.env.DISCORD_REDIRECT_URI,
});

const tokenRes = await fetch('https://discord.com/api/oauth2/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: params,
});
const { access_token } = await tokenRes.json();

// Get user profile
const userRes = await fetch('https://discord.com/api/users/@me', {
  headers: { Authorization: `Bearer ${access_token}` },
});
const user = await userRes.json();
// user.id, user.username, user.avatar

Step 4 — Create a session

1. Store user.id in your database (upsert on each login).
2. Issue a signed session cookie (JWT or encrypted session ID).
3. Never expose the Client Secret in frontend JavaScript.
4. Use HTTPS in production and set SameSite=Lax on cookies.

Step 5 — Bot authorization (for VC bots & delivery)

OAuth login identifies the user. To add bots to their server, use a separate bot invite:

1. In the Developer Portal, go to Bot → create bot → copy token (server-side only).
2. Enable Server Members Intent if needed for member delivery.
3. Generate invite URL with permissions:

https://discord.com/api/oauth2/authorize
  ?client_id=YOUR_CLIENT_ID
  &permissions=3148800
  &scope=bot%20applications.commands

Permissions 3148800 = Connect, Speak, View Channels. Adjust as needed.

Step 6 — Wire the login button

Update app.js with your Client ID:

const DISCORD_CLIENT_ID = 'YOUR_CLIENT_ID';
const REDIRECT_URI = encodeURIComponent(
  'http://localhost:3000/auth/discord/callback'
);
const loginUrl =
  `https://discord.com/api/oauth2/authorize` +
  `?client_id=${DISCORD_CLIENT_ID}` +
  `&redirect_uri=${REDIRECT_URI}` +
  `&response_type=code` +
  `&scope=identify%20email`;

document.getElementById('loginBtn')
  .addEventListener('click', () => {
    window.location.href = loginUrl;
  });