hoaxeyehoaxeyedocs
Detection · live

Discord verify

Discord verify is a hardcoded gate: there's no per-server toggle to turn it off, on purpose. The escape valve is an explicit, time-boxed, audited bypass — not a configuration switch.

Why hardcoded

Discord verification is one of the most-attacked surfaces on a FiveM server: a soft toggle becomes the first thing an attacker tries to flip. Removing the toggle and replacing it with an audited bypass means there's exactly one path to disable it — leaving a paper trail. This is a deliberate architectural choice; see Rule engine for the broader pattern of "we produce verdicts, the operator decides".

Verdicts

VerdictWhat it means
verifiedPlayer's Discord membership in the configured guild was confirmed at connect time. The verdict is cached for a short window so a reconnect doesn't pay the API cost twice.
bypass_activeThe server is in an active emergency-bypass window. Connects pass without a Discord check. Bypass windows are time-boxed and audited — see below.
deniedDiscord lookup succeeded but the player isn't a member of the configured guild. The action (deny / kick / queue) is operator-configured.

Latency

< 5 ms
Connect-gate check
In-process cache hit. The Discord API call happens on a cache miss only — once per player per cache window.
every 60 s
Boot pull cadence
The server periodically refreshes its membership snapshot. A user removed from Discord will be denied within a minute on their next connect.
1 hour max
Bypass — per request cap
No single bypass request can authorise more than one hour of unverified joins. Longer outages need a second request.
24 h per 30 d
Bypass — cumulative cap
Across a rolling 30-day window, the same server can spend at most 24 hours total in bypass mode. Forces operators to fix the underlying Discord issue.

Emergency bypass — when and how

The bypass is for the case where Discord verification can't reach a verdict for reasons unrelated to your players: Discord itself is down, your bot got removed from the guild, DNS is unhappy. Don't use it as a per-user override — it widens the gate for everyone.

To start a bypass:

  1. Open the dashboard as the server owner.
  2. Pick the affected server and use Settings → Config overrides → New bypass.
  3. Pick a duration up to one hour and write a short reason. The reason lands in the audit log alongside your username and the timestamp.
  4. Confirm. The server enters bypass mode on its next 60-second pull.

To end a bypass early, the same screen has a one-click cancel — also audit-logged.

Operator recommendation

  • Wire up the Discord guild ID in Server setup on day one. Don't postpone — the gate fails closed if it's misconfigured.
  • Subscribe your operator team to the audit log channel. The log entries show who opened a bypass and why — good to have visible to the whole team, not buried.
  • If you find yourself opening bypasses repeatedly, that's a signal: either Discord guild membership is too volatile, or the bot keeps getting kicked. Fix the upstream cause; don't normalize the bypass.