A Discord bot invite link is just an OAuth2 authorization URL: its scope parameter decides what kind of access is being requested (a bot account, slash commands, or both) and its permissions number decides what that bot account can do once it's in, and a server admin has to approve the whole thing before any of it takes effect. Understanding those two parameters is the difference between building a safe invite link and copying one you can't fully account for.
Anatomy of an invite link
A typical bot invite looks like this:
https://discord.com/oauth2/authorize?client_id=123456789&permissions=268446800&scope=bot%20applications.commands
- client_id - the application's public ID, safe to share, it's in every invite link for that bot.
- scope - what kind of access is being requested, space-separated (URL-encoded as
%20). - permissions - a single number representing every server permission being requested, added together.
- guild_id and disable_guild_select (optional) - pre-select a specific server and lock the picker to it, useful for a per-server "add me here" button.
The "bot" scope
This is what actually adds the bot as a member of the server, the entry that shows up in the member list with the bot tag next to it. Without this scope, nothing joins; there's no bot account to authorize.
The "applications.commands" scope
This one registers the application's slash, user, and message commands so they can be used in that server. A bot can technically join with only the bot scope, but none of its /commands will show up when someone types /, because the server never authorized command registration.
Why you almost always want both
A bot invited with only bot can still post messages, react to buttons on messages it already sent, and respond to things that don't require a slash command. But modern Discord users expect commands, and a bot that can't register them looks broken even when it's working fine. Every invite link Noxyr generates, and almost every legitimate bot's, includes both scopes together for exactly that reason.
The permissions number, decoded
Each Discord permission, sending messages, managing roles, kicking members, is a single bit in a bitfield: a power-of-two flag. The number in the invite link is the sum of every flag being requested at once. A link asking for permissions=8 is asking for exactly one thing: Administrator, full unrestricted access to the server. A well-built invite link instead sums only the specific flags the bot's code actually uses, channel management for creating ticket channels, role management for a verify role, moderation actions for anti-raid response, not everything Discord makes available.
Why Administrator is a red flag, not a requirement
Most legitimate bots don't need it. Requesting it is either a genuine, rare need for something that touches nearly every permission at once, or, far more often, a bot built quickly with permissions=8 pasted in because it was the easiest number to reach for. It's also the single scariest screen Discord shows a server owner during setup, which makes it a common reason an invite gets declined outright or the bot gets removed later by someone tidying up permissions. You can decode any invite link's permissions number with a Discord permissions calculator before clicking Authorize, to see exactly what's being asked for.
How Noxyr's invite link is built, as an example
Rather than requesting Administrator, Noxyr's invite is built from the specific permissions its features actually use: channel and role management for tickets and verification, message and moderation permissions for anti-nuke responses, and nothing beyond that list. It always includes both the bot and applications.commands scopes, so its commands work the moment it joins.
Other OAuth2 scopes you'll see mentioned
Discord defines dozens of OAuth2 scopes beyond bot and applications.commands, most of them, like identify or guilds.join, belong to "Login with Discord" style web authentication rather than bot invites, and won't show up in a standard invite link at all. If a link you're looking at requests something unfamiliar alongside bot, it's worth checking what that scope actually grants before authorizing it, since a bot invite legitimately needing extra web-auth scopes is unusual outside of a service that also offers account linking.
Building your own custom bot's invite link
Once you've created an application in the Discord Developer Portal, the OAuth2 tab's URL Generator builds this link for you by checkbox, tick bot and applications.commands under scopes, tick the permissions your bot needs, and copy the result, rather than assembling the URL and the permissions number by hand.
Common questions
What does disable_guild_select do? It locks the server picker to one pre-chosen server, so an invite link meant for one specific community can't accidentally be used to add the bot somewhere else.
Do I need applications.commands if my bot only uses buttons? Not strictly for buttons on messages it already sent, but you need it the moment any slash command is involved.
Can changing the permissions number later add access retroactively? No. A server that already approved an invite keeps whatever was granted at that time; changing the link only affects future invites, existing installs need to be reinvited and re-approved to gain more.
Is scope=bot enough on its own? It's enough for the bot to join, but its slash commands won't appear without applications.commands alongside it.
Why does Discord show such a big warning for Administrator? Because it's asking for unrestricted access to the entire server, the single most dangerous permission a bot invite can request.
Setting up your own bot's invite? See our guide on creating a Discord application first, then read the Custom Bot docs if you'd rather skip writing the code behind it entirely.