One Discord sign-in, every bot
Discord matches an OAuth redirect URI character for character, against a list only its web portal can edit. Left alone, that means every new bot and every new domain is another hand-edit in a browser, forever.
This service is the one redirect URI in the world. A bot registers once, points its login here, and gets back a signed identity token it can verify against a published key set. Nothing secret is shared with it, so any number of products can check a login and none of them can forge one.
Wire up a new bot · about ten minutes, most of it in Discord's portal.
The shape of it
your-bot.lunarwerx.com/login
│
▼
https://auth.lunarwerx.com/authorize?app=your-bot&origin=…&code_challenge=…
│
▼
discord.com/oauth2/authorize the person approves
│
▼
https://auth.lunarwerx.com/callback the ONE registered URI
│
▼
your-bot.lunarwerx.com/api/auth/return?code=…
│ server-to-server, with the PKCE verifier
▼
https://auth.lunarwerx.com/token → { id_token, discord: { access_token, … } }The one-time code in that return URL is worthless on its own. Redeeming it requires a verifier that never leaves your server, so a code copied out of a log or a referrer header buys nothing.