2 min read
By Mike
Discord OAuth2 Scopes: What Each One Lets an App Do
OAuth2 scopes are the named permissions an app asks Discord for when you sign in with it or add its bot to a server. Each scope covers one kind of access, and Discord shows the list before you approve, so you can see exactly what you are granting.
How the consent screen works
When you click an invite link or "Login with Discord", you land on a Discord page that lists what the app wants. The list comes from the scope part of the link. Nothing is granted until you press Authorize, and the app gets only the scopes shown.
Scopes you will see most
bot: adds the bot user to a server you choose. The link can also request permissions in the same step.applications.commands: lets the app create slash commands in the server. A bot invited without it may have no commands.identify: reads your basic account details such as ID, username and avatar.guilds: reads the list of servers you are in, so a dashboard can show the ones you can manage.email: reads your email address, only when an app truly needs it.
Adding a bot needs Manage Server on the server you pick. Signing in to a dashboard needs no such right, but the dashboard will only let you manage servers where you are an admin.
What to check before approving
Look at the app name and the scope list. A bot invite asking for Administrator when it only plays music is a warning sign. A sign-in asking for more than identify and guilds deserves a second look. You can later review and remove connected apps in User Settings, Authorized Apps, and remove a bot by kicking it from the server.
Scopes only describe what an app may request. They are not a way to read your messages or password, and Discord never gives an app your password.
Scopes with Noxyr
Noxyr's invite link asks for a fixed list of permissions, not Administrator, and the permissions reference says what each one is for. Signing in to the dashboard uses Discord login, and the site stores your Discord ID, username, avatar and language preference for that, as the data and privacy docs describe. The Noxyr MCP also signs in through Discord, see MCP.
For a full walk through of an invite URL, read invite links and OAuth2 scopes explained, or build one with the invite link generator.
Common questions
What does the applications.commands scope do?
It lets the app register slash commands in your server. Without it, a bot might join but show no commands.
Does OAuth2 give an app my password?
No. Discord never shares your password. The app only receives the access listed in the scopes you approve.
How do I remove an app I authorized?
Open User Settings, Authorized Apps, and remove it. To remove a bot from a server, kick it or remove it in Integrations.
