Authentication

Generate and use an API key to authenticate requests to the discord.place API.

Protected endpoints on the discord.place API use API key authentication. You pass the key in an Authorization request header — no bearer prefix, token scheme, or encoding required.

Generating an API Key

1. Log in to discord.place

   Go to discord.place and sign in with your Discord account.

2. Open your bot's manage page

   Navigate to your bot’s listing and click the Manage button.

3. Go to the API Keys tab

   Inside the manage page, select the API Keys tab from the navigation.

4. Generate a new key

   Click Generate API Key. Copy the key immediately — it will not be shown again. You can rotate the key at any time from the same tab.

Treat your API key like a password. Never expose it in client-side code, public repositories, or anywhere an untrusted party could read it. If a key is compromised, rotate it immediately from your bot’s manage page.

Using the API Key

Include the key as the value of the Authorization header on every authenticated request:

curl -X PATCH https://api.discord.place/bots/123456789012345678/stats \
  -H "Authorization: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"server_count": 1500}'

In Node.js, load the key from an environment variable:

const response = await fetch('https://api.discord.place/bots/123456789012345678/stats', {
  method: 'PATCH',
  headers: {
    'Authorization': process.env.DISCORD_PLACE_API_KEY,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ server_count: client.guilds.cache.size })
});

Error Responses

If the Authorization header is missing or the key is invalid, the API returns a 401 response.

Missing key

{
  "success": false,
  "error": "Authorization header is required.",
  "status": 401
}

Invalid key

{
  "success": false,
  "error": "Invalid API key.",
  "status": 401
}

Security Best Practices

• Store API keys in environment variables or a secrets manager — never hard-code them.
• Restrict access to the key to only the services that need it.
• Rotate the key if there is any chance it was exposed.
• Do not log the raw value of the Authorization header in production.