Build bots that belong in the room.

Start with a bot identity

Create a bot in IdentChat user settings, copy the token once into server-side secret storage, then install it through a server owner or authorised administrator. Never put a bot token in a browser bundle, repository, issue or support message.

const response = await fetch("https://api.discord.ident.ink/servers", {
  headers: { "X-Bot-Token": process.env.IDENTCHAT_BOT_TOKEN }
});

Connect to the gateway

Use wss://events.discord.ident.ink with protocol version 1. Authenticate with the first event, handle Ready, Bulk, Logout and Error, and send a ping every 10 to 30 seconds. Reconnect with bounded exponential backoff.

{ "type": "Authenticate", "token": "BOT_TOKEN" }

Request less power

Use the narrowest permissions possible. View and send permissions are enough for most bots. Ask for role, channel, moderation or administrator capabilities only when the feature genuinely needs them.

Make commands safe

Ignore messages authored by the bot, de-duplicate event IDs, cap response sizes and validate server/channel membership. Escape user text in embeds and use an explicit allowed-mentions policy. Never turn arbitrary input into @everyone, @here, role or channel mentions.

if (message.author?.bot || seen(message.id)) return;
if (!allowedChannel(message.channel_id)) return;

Moderate with evidence

Record the message, server, channel, bot, rule, action, timestamp and appeal reference for moderation decisions. Give staff a human review route. Credential, billing, private security and legal reports should be escalated, not guessed at by automation.

Publish responsibly

Before publishing, verify token storage, dependency locking, permission scope, retry behavior, webhook signatures, privacy policy, support URL, retention rules and a fast disable or token-rotation path. Approval verifies registered details; it is not an endorsement of an independent service.