Skip to main content
Version: Beta 🚧

Authentification Manager

RaidProtect's Authentification Manager (AM) protects access to your most sensitive Discord roles through real identity verification. Using passkeys (WebAuthn), PIN codes and OTP, a member only obtains a sensitive role after authenticating, and only for a limited time. In Discord, the module is displayed under the name "Authentification Manager".

❓ How does the Authentification Manager work?​

The Authentification Manager is based on protected roles and temporary sessions. When an administrator protects a role with AM:

  1. The Discord role is no longer permanently assigned: you have to authenticate to obtain it.
  2. Authorized members authenticate with the /auth command (or the "Take a role" button of a staff panel).
  3. A temporary session is created for the duration set on the role.
  4. When the session expires, we automatically remove the role.
info

Each member must first create their authentication profile with /auth-profile before they can authenticate.

During a session, the member's Discord actions (bans, message deletions, pins, channel changes...) are recorded in the AM log, with their target: you know what was done with each protected role.

🔐 Security grades​

Each authentication method gives a security grade. Each protected role requires a minimum grade that the member must reach.

GradeCondition
icon RankSAt least one registered passkey
icon RankAOTP (2FA) code enabled
icon RankBReinforced PIN of 8 digits or more
icon RankCReinforced PIN of 6 digits or more
icon RankDSimple PIN of 6 digits or more
icon RankESimple PIN of 4 digits or more
tip

The highest grade among your configured methods is automatically retained. For example, if you have a simple PIN (grade D) and a passkey (grade S), your grade will be S.

🛡️ Authentication methods​

The PIN code is the simplest method. Two modes are available:

  • Simple PIN: classic input in a window (4 to 12 digits).
  • Reinforced PIN: numeric keypad whose keys change place on every input (6 to 12 digits), to prevent a third party from guessing your code by watching you.
warning

PINs that are too simple are rejected: repeated digits, ascending or descending sequences, and common patterns.

👤 Authentication profile (/auth-profile)​

The /auth-profile command manages your personal authentication profile. It works on any server and in private messages, and your profile is the same everywhere.

@Bastien
PIN codeReinforced
2FA codeConfigured
Passkeys
2 days ago 2FA enabled2 days ago PIN code added
Your Security Grade is , Add a passkey to reach the maximum grade.

First use​

On first use, a welcome screen presents the grades, temporary sessions and methods. Click "Continue" to configure your first method.

Managing authentications​

From your profile, you can:

  • Add, change or delete a PIN code (simple or reinforced).
  • Enable the 2FA code (OTP) with a QR code or a secret key, regenerate it or delete it.
  • Add a passkey from the registration page, or delete one. Each passkey displays the device name and its date of last use.
  • Rename a passkey: the "Edit Passkey" button, next to "Add", opens a window with your passkeys and the new name to give (for example MacBook, iPhone, YubiKey). The rename is recorded in your audit log.

If you already have a method, we ask you to authenticate before adding or changing one. The bottom of the profile reminds you of your grade and the method to add to go up a notch.

info

Deleting a method may lower your grade. Your access to roles that require a higher grade is then disabled.

Active sessions​

Your active sessions, with their expiration, are displayed in the /auth command's panel on each server.

Audit log​

Your profile shows the last 3 actions performed on your account. The "View full logs" button opens the full, paginated log, with the server concerned.

Account reset​

The "I forgot my auths" button completely resets your account. This action:

  • deletes all your authentication methods (PIN, 2FA, passkeys);
  • disables your access to protected roles on all servers;
  • requires you to reconfigure everything.
danger

This action is irreversible. All your access is revoked immediately.

🔑 Authenticate (/auth)​

The /auth command allows you to authenticate to obtain a protected role.

Use the command: /auth [role]

Authentication process​

  1. Run the /auth command on the server, or click "Take a role" in a staff panel.
  2. A menu displays the available roles with their required grade and session duration.
  3. Select one or more roles (up to 10). A single authentication, at the level of the most demanding one, opens them all.
  4. Choose an authentication method from those that reach the role's grade.
  5. Complete the verification (PIN, OTP or passkey).
  6. On success, we assign you the Discord role or roles and create a session for each. The sessions are recorded in the Authentication Manager logs.
info

Only roles you are assigned to with the Active status appear in the menu.

Session management​

The /auth panel lists your active sessions. For each one, you can:

  • Extend session: authenticate again to start over with a full duration.
  • Disconnect: the session is revoked immediately and the Discord role removed.

Security​

  • Warning: a warning message appears starting from 3 failed attempts.
  • Lockout: after 5 failures, your account is locked for 1 hour.
  • Reset: after 10 failures, your account is reset and all your access is revoked.

⚙️ Server configuration​

The Authentification Manager configuration panel opens in two ways:

  1. Run the /settings command.
  2. Open the "Protection" tab.
  3. Click "Configure" next to "Authentification Manager".

The panel then replaces the dashboard, with a "Back" button to return to the Protection tab. You can also directly use the /auth-settings command, which opens the same panel.

Authentification Manager
Server configuration Default Session Time : 10m
Default Minimum Grade :
Min Managers Grade :
Webhook : not set
@Administrateur • 30m • 2 users
@Modérateur • 60m • 3 users
Empty slot
Empty slot
Empty slot
info

The /auth-settings command is reserved for administrators by default. For a non-administrator manager to be able to use it, allow it for them in Server Settings > Integrations > RaidProtect.

Permissions​

RoleAccess
OwnerFull access
AdministratorFull access (unless the Administrator permission comes from a role protected by AM)
ManagerLimited access: must authenticate, only manages the roles and users below them, cannot change the server configuration

Manager authentication​

A manager who is neither owner nor administrator must authenticate every time they open the panel. We offer them the methods that reach the minimum manager grade: "Authenticate with PIN", "Authenticate with OTP" or "Authenticate with Passkey". The reinforced PIN is entered on the shuffled-key keypad.

The same protections as for /auth apply: warning from 3 failures, one-hour lockout at 5 failures, account reset at 10 failures.

Server settings​

Click "Edit" next to "Server Configuration" to open the "Server Authentication Configuration" window:

  • Default Session Time: duration offered for new roles, in the format 30m, 2h or 1d. Up to 8 hours in the free version, 24 hours in the premium version. Default: 10 minutes.
  • Default Minimum Grade: grade offered for new roles. Default: A.
  • Min Managers Grade: grade a manager must reach to open the panel. Default: A.
  • Webhook URL (leave empty to clear): Discord webhook that receives the AM logs (optional). Only Discord webhook URLs are accepted.

Managers cannot change these settings.

Roles tab​

The Roles tab lists your protected roles with their grade, session duration and number of users. Below the tabs, the "Last sessions" block shows the most recent one, and "View all" opens the list of all sessions.

info

Limits: 3 roles in the free version, 10 roles in the premium version. Disabled roles still occupy a slot.

Add a role​

  1. Open the Authentification Manager panel (see above).
  2. In the "Roles" tab, click "Add".
  3. Choose the Discord role to protect.
  4. Choose the minimum security grade.
  5. Enter the session duration.
  6. Choose an integration strategy (see below).
  7. We detect the members who already have this role: adjust the selection, then click "Send invitations" (or "Skip").

Each chosen member is attached to the role with the Active status if their grade is sufficient, otherwise Invited: they then receive a DM inviting them to set up /auth-profile.

We refuse a role managed by an integration, a role used in Discord's Onboarding Process, a role above RaidProtect's role or above yours, and a role that is already protected.

Integration strategies​
StrategyEffect
"Use this role as-is"The chosen role directly becomes the protected role. This is the default choice.
"Create a separate permissions role"We create a 🔑 <role name> role with the original permissions, just below the chosen role, and empty the original role's permissions. The original role permanently keeps its color and display, the new role is the one that is protected.
tip

If your role is displayed separately in the member list, choose "Create a separate permissions role": your members keep their visible role permanently, and the sensitive permissions are only granted during authenticated sessions.

With a separate role, the channel moderation permissions of the display role also move to the 🔑 role. For an administrator role, the "Keep view of all channels outside sessions" option leaves the display role able to view all channels outside sessions; without it, it no longer sees anything without the administrator permission.

Protect administrator roles from /audit​

The audit's administrator roles check offers "Integrate all": you protect in one go the administrator roles that are not yet protected, 5 roles at most per batch and within your free slots. Only roles below RaidProtect and below your highest role are offered.

Edit a role​

Click "Edit" on the role's row to open its sheet (minimum grade, session duration, assigned users), then "Edit" to change the minimum grade and the session duration.

Enable / Disable a role​

From the role's sheet, "Disable" pauses the role without deleting it: no session is created for it anymore. Ongoing sessions are revoked and the Discord role is removed from the members concerned. "Enable" puts it back in service, within your slots.

Delete a role​

"Delete" permanently removes the role from the Authentification Manager, along with all user assignments. You are asked for confirmation.

Users tab​

The Users tab lists the members attached to at least one protected role, with their grade, number of roles and manager status.

info

Limits: 20 users in the free version, 50 in the premium version.

Add a user​

  1. Open the "Users" tab.
  2. Click "Add".
  3. Choose the user and the Authentication role to assign to them.

The member receives a DM: they can use the role right away if their grade is sufficient, otherwise they are invited to set up a method of sufficient grade.

info

Invitations are limited to prevent spam. Blocked ones can be resent later from the member's sheet.

User sheet and statuses​

Click "Manage" to open a member's sheet: their grade, their ID, whether they are a manager, and each of their roles with its status. The role selector lets you add or remove some.

StatusDescription
InvitedThe member has been added but their grade is not yet sufficient (profile to set up)
PendingAwaiting approval: click "Approve"
ActiveThe member can authenticate to obtain the role
DisabledAccess is suspended: click "Restore" to reinstate it

Promote to manager​

"Make Manager" gives the member access to the configuration panel, provided they reach the minimum manager grade. A manager manages the users and roles below them. "Remove Manager" removes this access.

Delete a user​

"Delete User" removes the member from all protected roles on the server. You are asked for confirmation.

Logs tab​

The Logs tab shows the Authentification Manager's log, paginated: sessions granted, extended or revoked, configuration changes... The eye-shaped button opens an entry's details (user, action, type, date, role and target). Logs are also sent to the configured webhook.

Sessions​

There is no dedicated tab: the "Last sessions" block of the Roles tab shows the most recent session, and "View all" opens the list of all the server's sessions with their status (Active, Expired, Revoked). "View" shows a session's details and its latest actions.

Onboarding Process protection​

If a protected role is added to the questions of Discord's Onboarding Process, we automatically remove it from the question and record it in the logs: otherwise, any newcomer could obtain the role without authenticating.

End of Premium​

When a Premium subscription ends, active roles beyond 3 are automatically disabled (the oldest are kept) and session durations over 8 hours are brought down to 8 hours.

Frequently asked questions​

Which authentication methods are available?​

There are three methods: the PIN code (simple or reinforced), OTP (a 2FA code following the TOTP standard) and passkeys (WebAuthn). Passkeys offer the highest level of security (grade S).

Where do I configure the Authentification Manager?​

In /settings, Protection tab, by clicking "Configure" next to "Authentification Manager", or directly with the /auth-settings command.

What happens when a session expires?​

The protected role is automatically removed from the member. They must re-authenticate via /auth to obtain it again, or extend their session before it expires.

What if I forget my credentials?​

From your /auth-profile, the "I forgot my auths" button fully resets your account: all your methods are deleted and your access is revoked. This action is irreversible and requires a complete reconfiguration.

How many roles can I protect with the Authentification Manager?​

You can protect 3 roles in the free version and 10 roles in the premium version, for 20 and 50 users respectively. Sessions last at most 8 hours in the free version and 24 hours in the premium version.

Can a manager change everything?​

No. A manager must authenticate every time they open the panel, only manages the roles and users below them, and cannot change the server configuration.

Didn't find what you were looking for?

Search the whole documentation, the glossary and the blog.

RaidProtect
Join the support server