Remote Authentication (Mobile)

In the context of remote authentication, the mobile client is the device that is logged in and willing to transfer credentials to the desktop client. See the introduction for more information.

Protocol

Upon scanning the QR code, the mobile client should extract the fingerprint from the received URL (the URL should be in the format https://discord.com/ra/<fingerprint>).

Once the client has a fingerprint, it can create a new remote auth session using Create Remote Auth Session. After the session has been established, the client should prompt the user to either accept or deny the request, and then perform this action using Finish Remote Auth or Cancel Remote Auth.

Endpoints

Create Remote Auth Session

POST/users/@me/remote-auth

Creates a new remote auth session. This sends the current user info to the desktop client.

JSON Params
FieldTypeDescription
fingerprintstringThe fingerprint corresponding to the desktop remote auth client
Response Body
FieldTypeDescription
handshake_tokenstringThe handshake token that can be used to finish or cancel the session
Example Response
{
  "handshake_token": ".eJwVkcmSokAARP_Fq0MrICIdExNRYOECsigt4GUCpCgKZC9A6Jh_H_qWkS_z9L4XRRmhxeeiQXlJERN0NGFwQNEQjEzVREwekILBYk8XvxYViebl7_UHy0nbD4Hjtn9-2i58keffDI0zvJxO8ikFhoyzOsnIQRrWMrChCoCpAHsHfriCtTlD0Efmmm6yIp0IyU3Xqh_x-7gStVU3VncD0YPlbZUq13bQTZ5Vfuv5UociKa9o4tsrpW0YxlN5o8hJ3mxgIs3NuDxrB5t04uT52zwAV2cP-4to-ZrFtkF8O661rsKm8CBRYZPaIJCeVff4bNG46YYG5KEEy57FUFar4LDVAOxPHvsKRzGwJQrfkn69ZVjodc5MdyvNp1ZZi6p98KaXEeovaADgAGq4S8vBUTRekH6_sRKHU37ZjpMAqnOw11Ez8nIb5piEvhBmPZryM1ajJnf5DutdXTzEOnoWp7sq6Ks0lvda7bylOG-Mwq2VFCciai8edFvS3Aek1PoxvTRLtnv1fKoNpz2wgTx7iUmBUVM1pKCzmC_iHGiQbiNlE2mGs4OR5COg7_ma7mJmCr0g4fBd9ouv9fztUdOSslh8cv_-A8Mft7I.ZSQp6A.dPkJdzlOjDn1hIxolxZfDu2595k"
}

Finish Remote Auth

POST/users/@me/remote-auth/finish

Finishes a remote auth session. This ends the remote auth session by sending an authentication token to the desktop client. Returns a 204 empty response on success.

JSON Params
FieldTypeDescription
handshake_tokenstringThe handshake token that represents the remote auth session
temporary_token? 1booleanWhether the authentication token should expire (default false)

1 Expiring authentication tokens are not yet supported.

Cancel Remote Auth

POST/users/@me/remote-auth/cancel

Cancels a remote auth session. This ends the remote auth session without sending an authentication token. Returns a 204 empty response on success.

JSON Params
FieldTypeDescription
handshake_tokenstringThe handshake token that represents the remote auth session