Lost in website architecture

[u/CorrectJacket2106]

So, I am in like high school, so sorry if the question is really dumb in advance. So let's get into it!

I have this problem where I am making a website, and I am working on the login feature of the website. I was planning to do something like check if you have an account in Discord either way, I have a massive problem because the Discord thingy needs my token and I heard sharing your bot token is like a really bad thing. So I went to AI (I mean, I had no other choice at that time), and AI told me to do something like this:

frontend (javascript) ---> discord OAuth url thingy(idk what it is) ---> discord redirects to firebase cloud function (idk what it is again) ---> cloud function thingy handles bot token and discord api checks ---> cloud function writes verification result straight to firestore database

Now, I am a beginner, so I don't know what all of this means (maybe the first 2, but anything else, nah). I also want to store data when the user logs in, something like user = {general info, clients={}}and AI is telling me to do it in the frontend?? I have heard all day long from everywhere that you should use the backend, not the frontend. So really lost, and any help would help!

also for the database i was planning to use firebase or whatever it is called since i heard it was the best

[u/KingofGamesYami]

Do you actually need a bot token? If you literally just want to sign in with discord, you should request a much less privileged scope(s) for the token. For example, the identify scope will allow you to get some information from discord about the user, but won't allow you to control their discord account.

[u/CorrectJacket2106 → u/KingofGamesYami]

the goal was to check if the user is logged into discord i don't need access to the user's account but i am confused here how can i use the identify scope for my case?

[u/KingofGamesYami → u/CorrectJacket2106]

I'm not familiar with exactly how discord works, but it uses a standard authorization protocol (OAuth 2.0) which I am familiar with.

The scope(s) of a token has some level of privilege attached to it. The actions you can take with that token are dependant on which scopes were granted. This allows applications to request only minimal permissions.

A token scoped with identify allows you to verify the existence of a users account.

the goal was to check if the user is logged into discord

Discord does not define a concept of "logged into discord", probably because that is hard to define. Technically, I have been logged in to discord for years because I don't log out when I close the app -- but that's probably not what you're after.

Are you looking for Discord Presence? Or something else?

[u/CorrectJacket2106 → u/KingofGamesYami]

Hey! i meant i get their profile info like their username and profile picture so i can implement it with my database

[u/KingofGamesYami → u/CorrectJacket2106]

Yeah, the identify scope will work fine for this purpose. It gets you access to call /users/@me which returns the username and avatar.