Discord Bot Platform  ·  View 19 of 19  ·  Assurance

Identity — Install and Token Use

The server grants; the bot presents; the platform checks both, repeatedly.

Editable source SVG draw.io All views
Administrator Consent Screen Installation Service Token Service Gateway Bot 1. open invite link 2. list scopes + perms 3. approve 4. create installation 5. entitlement push 6. identify(token, intents) 7. verify hash 8. application id 9. ready (guilds) 10. revoke 11. close session ≤ 10 s Discord Bot Platform — Identity: Install and Token Use v 1.0 · owner Integration Platform Architecture · date 2026-10

Decisions

  • Installation is owned by the server, so removing a developer account removes nothing (ADR-06).
  • Revocation pushes to the Gateway and closes sessions within 10 s (ADR-08).

Assumption

  • 10-second revocation is a stated assumption; the lease TTL is what makes it true.
◀  Security and Trust Zones All views
Solution Architecture v1.0 · Microsoft Azure · Integration Platform Architecture · 2026-10 · 19 views · 12 architecture decision records19-identity-and-install