Set up verification
without guesswork.
Everything administrators need to add Triple Counter, configure verification, understand the OAuth2 flow, and resolve access issues.
01
Add Triple Counter
Install the bot with only the permissions needed for verification. You do not need to grant Administrator.
- 1
Select Add to Discord and choose the server you want to protect.
- 2
Review the requested permissions. Triple Counter never asks for Administrator.
- 3
Open the server and run /setup. Choose a verification channel and the role members should receive.
- 4
Triple Counter posts a verification panel. Members can now press Verify with Discord.
Enable Server Members Intent
02
Required bot permissions
Triple Counter uses Discord's native permission system and asks for the smallest workable set. The bot role must sit above the verified role.
Slash commands are registered through the applications.commands scope. Administrative commands also require the Manage Server permission from the person running them. Role assignment additionally requires the bot's highest role to be above the verified role in the Discord role list.
03
Configure verification
Configuration can be managed with slash commands or from the server settings page in the dashboard. Changes persist to PostgreSQL and are reflected by the bot.
/setup channel:#get-verified role:@Verified
/setup welcome_channel:#welcome log_channel:#mod-logs retention_days:90
/config
/resetVerification URLs are generated securely
APP_URL to the deployment origin and add the matching OAuth redirect URI.Verification channel
Where the public panel and verification button live. The bot needs View Channel, Send Messages, and Embed Links in this channel.
Verified role
The role applied after a successful verification. Pick a normal, manually assignable role. Integration-managed roles cannot be assigned.
Verification message
The member-facing copy in the verification panel. Supports {server}; keep it short and specific.
Automatic role assignment
When enabled, the bot always requires a role and applies it through the durable job queue. When disabled, verification is still recorded but no role is applied.
Welcome & logging
Choose an optional welcome channel, toggle join DMs and welcome messages, select a moderation log channel, and set a 7–365 day retention window.
Changing settings after launch
/setup refreshes it immediately.04
How Discord OAuth2 works here
Triple Counter uses Discord OAuth2 solely to confirm account identity and, for the dashboard, which servers you can manage. It never receives your Discord password.
A signed link
When a member requests a link, the bot issues a short-lived HS256 token bound to their Discord user ID, your server ID, and an expiry. Links cannot be reused for another account or server.
State + PKCE
The web app creates a random OAuth state and stores its hash server-side with a PKCE verifier. The callback only proceeds when the state cookie, database record, and one-time claim all validate.
Minimal scopes
Verification requests identify only. Dashboard sign-in requests identify and guilds so we can discover servers where you have moderation permissions. Message content and email are never requested.
Server-side exchange
The authorization code is exchanged for a token on the server. The token is used once to read your profile and is not stored. Client secrets never reach the browser.
Idempotent completion
The completion endpoint verifies the signed link against the signed-in Discord account, creates one verification event, and queues a role job inside a serializable transaction. Repeated clicks return the existing event instead of duplicating it.
MEMBER VERIFICATION
identify
Confirm the Discord account behind the signed link.
DASHBOARD
identify + guilds
Discover servers where you hold moderation permissions.
05
Channel permissions
Triple Counter does not change channel permissions or assign itself roles. You configure the verification channel and decide who can see what.
What Triple Counter needs
View Channel, Send Messages, and Embed Links in the verification channel; Read Message History if you want it to update the panel in place.
Your channels, your rules
Hide channels from @everyone, keep the verification channel visible to unverified members, and let the verified role open the rest — all in Discord's channel settings.
Role order
The Triple Counter bot role must sit above the verified role it assigns. That is the only role-position requirement.
Panel not appearing?
The /setup reply now includes Discord's exact reason, such as missing access in that channel. Fix it in Discord, then run /setup again.
06
Verification roles
Role assignment runs through a durable job queue, so a bot restart or a brief Discord outage never silently drops a verification.
- The bot re-fetches the member and role at processing time. Deleted roles and departed members fail cleanly instead of being assumed successful.
- The bot checks Manage Roles, role existence, role manageability, and role hierarchy before assigning anything.
- Transient Discord failures are retried with backoff. Permanent failures are visible in the dashboard and can be retried by an administrator.
- Duplicate role processing is prevented with atomic job claims and a unique event-to-job relationship.
- If automatic role assignment is disabled, the verification is recorded as successful without changing roles.
Role order matters
07
Logs and access control
Verification logs are isolated by server. Access follows Discord permissions and is checked again on every API request.
What is recorded
- Discord user ID and available display name
- Server ID and event type
- Verification status and processing result
- Event timestamps and role assignment time
Who can view
- Server owners and members with Manage Server
- Moderators with Kick, Ban, Timeout, or View Audit Log
- Nobody outside the server's access list
- Dashboard access refreshes on each Discord sign-in
Filters include date range, verification status, event type, and Discord username or ID search. Logs are paginated and retained for the server's configured window (90 days by default, 7–365 days configurable).
Open the log explorer08
Anti-botting
Triple Counter screens verification attempts so bots and duplicate alt accounts do not receive access to your server.
Bots refused
Discord bot accounts cannot complete member verification. The attempt is refused and recorded, and no role is assigned.
Duplicate requests coalesced
Repeated verification requests from the same account are processed once, so retries cannot create duplicate roles or log entries.
Alts refused
Attempts that duplicate an existing verified member on the same network are rejected for that server.
Recorded for your team
Blocked attempts appear in the server's verification logs so moderators can review patterns without chasing them manually.
Verify anti-botting is working
/stats in the server to review verification totals and failed attempts. Open Logs in the dashboard and filter by the Failed status to inspect blocked attempts.09
Troubleshooting
Most issues are caused by role hierarchy, channel permissions, or an expired verification link. Work through these checks first.
The bot cannot assign the verified role
Grant Manage Roles to Triple Counter and move its bot role above the verified role in Server Settings → Roles.
Verification link is expired or invalid
Links expire after 15 minutes. Run /verify in the server or press Verify with Discord again for a fresh link.
I am not a member of this server
The verification link belongs to the account that requested it and the target server. Rejoin the server, then generate a new link.
The verification panel is not visible
Check that the bot can View Channel, Send Messages, and Embed Links in the configured channel. Re-run /setup to repost the panel.
I cannot see the server in the dashboard
You need Manage Server, Administrator, or a moderator permission in that Discord server. Sign out and back in to refresh your guild permissions.
Discord authorization was cancelled
No changes were made. Start again from the verification page and approve the read-only Discord connection.
A verification is stuck on pending
Check the bot is online and has Manage Roles. A moderator with Manage Server can retry failed events from the dashboard.
The server has not finished setting up
An administrator must run /setup or complete the server settings in the dashboard before verification can succeed.
10
Security and privacy model
Triple Counter is built so that verification data stays useful to the server that collected it—and nowhere else.
Server-side sessions
Session tokens are random, hashed in PostgreSQL, HTTP-only, SameSite=Lax, and expire after seven days. Secrets never reach the browser.
CSRF + origin checks
Mutating requests require a per-session CSRF token and a trusted origin. OAuth state is one-time and stored server-side.
Signed tokens
Verification links use a dedicated HMAC secret, are bound to a server and user, and expire after 15 minutes by default.
Scoped audit trail
Every verification and settings action is attributable. Logs never expose one server's activity to another.
Triple Counter does not collect device fingerprints, message content, email addresses, or browsing data. Account deletion can be started from the dashboard and removes your login profile, sessions, memberships, and verification events. See the Privacy Policy for retention details.
Still stuck?
The support server has setup help and bug reporting.