OAuth2 Scopes for the Social SDK

OAuth2 scopes define the level of access your app has to a user's Discord account.

What OAuth scopes are available to your integration are set via AuthorizationArgs::SetScopes on AuthorizationArgs which is passed to Client::Authorize on Social SDK authentication.

At a minimum, the Social SDK uses the following scopes to use features like rich presence and friends list:

• openid
• sdk.social_layer_presence

The default presence features include:

• Account Linking
• Provisional Accounts
• Friend System & Relationships
• Presence & Rich Presence

The Social SDK provides the helper method Client::GetDefaultPresenceScopes, which returns openid sdk.social_layer_presence, that you can use when setting up your OAuth2 flow, for integrations that only need the above functionality.

The communications features are currently available but have limited access. Those features require the scope of sdk.social_layer, which includes the sdk.social_layer_presence scope but also allows your app to use those limited features on behalf of the user.

• openid
• sdk.social_layer

These communication features include:

• Messaging & Communication
• Lobbies & In-Game Chat
• Linked Channels

The Social SDK provides the helper method Client::GetDefaultCommunicationScopes, which returns openid sdk.social_layer, that you can use when setting up your OAuth2 flow, for integrations that integrates both the default and limited communications features.

If your game requires additional scopes, you can add them to the default scopes to authorize additional access from your users.

You should only add scopes that are necessary for your game to function. Requesting unnecessary scopes can lead to user distrust and may result in users not linking their Discord account.

OAuth2 has two client types: Confidential and Public. Most games will not want to ship with Public Client enabled.

Some Social SDK methods require your Discord application to be a Public Client. These methods also have server-side alternatives that you can use with a Confidential Client.

• Using confidential clients with proper secret management for production applications is generally recommended.
• Public clients cannot securely store client secrets.
• Your security team should review this setting and authentication flows before releasing your game.

Learn more about OAuth2 client types

Start your integration, implement user authentication, and learn about UI design: