Authentification Manager

Legitimate user

@Admin role granted · 8h session

Message #staff

Zallom

zallom

AdminMember+

RaidProtect's Authentification Manager (AM) protects access to your most sensitive Discord roles through real identity verification. Using passkeys (WebAuthn), PIN codes and OTP, a member only obtains a sensitive role after authenticating, and only for a limited time. In Discord, the module is displayed under the name "Authentification Manager".

❓ How does the Authentification Manager work?

The Authentification Manager is based on protected roles and temporary sessions. When an administrator protects a role with AM:

1. The Discord role is no longer permanently assigned: you have to authenticate to obtain it.
2. Authorized members authenticate with the /auth command (or the "Take a role" button of a staff panel).
3. A temporary session is created for the duration set on the role.
4. When the session expires, we automatically remove the role.

info

Each member must first create their authentication profile with /auth-profile before they can authenticate.

During a session, the member's Discord actions (bans, message deletions, pins, channel changes...) are recorded in the AM log, with their target: you know what was done with each protected role.

🔐 Security grades

Each authentication method gives a security grade. Each protected role requires a minimum grade that the member must reach.

Grade	Condition
	At least one registered passkey
	OTP (2FA) code enabled
	Reinforced PIN of 8 digits or more
	Reinforced PIN of 6 digits or more
	Simple PIN of 6 digits or more
	Simple PIN of 4 digits or more

tip

The highest grade among your configured methods is automatically retained. For example, if you have a simple PIN (grade D) and a passkey (grade S), your grade will be S.

🛡️ Authentication methods

PIN

The PIN code is the simplest method. Two modes are available:

• Simple PIN: classic input in a window (4 to 12 digits).
• Reinforced PIN: numeric keypad whose keys change place on every input (6 to 12 digits), to prevent a third party from guessing your code by watching you.

warning

PINs that are too simple are rejected: repeated digits, ascending or descending sequences, and common patterns.

OTP (2FA Code)

OTP uses the TOTP (Time-based One-Time Password) standard, compatible with authentication apps such as Google Authenticator, Authy, 1Password, Dashlane or Bitwarden.

• 6-digit code renewed every 30 seconds.

Passkey (WebAuthn)

Passkeys offer the highest level of security (grade S). Authentication is done in the browser using:

• Fingerprint or facial recognition (Touch ID, Face ID, Windows Hello).
• Physical security key (YubiKey, etc.).

When you use a passkey, an external link opens in your browser, in your Discord's language. Once the verification is validated, the role is assigned to you.

👤 Authentication profile (/auth-profile)

The /auth-profile command manages your personal authentication profile. It works on any server and in private messages, and your profile is the same everywhere.

@Bastien

---

PIN codeReinforced

2FA codeConfigured

---

Passkeys

---

2 days ago 2FA enabled2 days ago PIN code added

---

Your Security Grade is , Add a passkey to reach the maximum grade.

First use

On first use, a welcome screen presents the grades, temporary sessions and methods. Click "Continue" to configure your first method.

Managing authentications

From your profile, you can:

• Add, change or delete a PIN code (simple or reinforced).
• Enable the 2FA code (OTP) with a QR code or a secret key, regenerate it or delete it.
• Add a passkey from the registration page, or delete one. Each passkey displays the device name and its date of last use.
• Rename a passkey: the "Edit Passkey" button, next to "Add", opens a window with your passkeys and the new name to give (for example MacBook, iPhone, YubiKey). The rename is recorded in your audit log.

If you already have a method, we ask you to authenticate before adding or changing one. The bottom of the profile reminds you of your grade and the method to add to go up a notch.

info

Deleting a method may lower your grade. Your access to roles that require a higher grade is then disabled.

Active sessions

Your active sessions, with their expiration, are displayed in the /auth command's panel on each server.

Audit log

Your profile shows the last 3 actions performed on your account. The "View full logs" button opens the full, paginated log, with the server concerned.

Account reset

The "I forgot my auths" button completely resets your account. This action:

• deletes all your authentication methods (PIN, 2FA, passkeys);
• disables your access to protected roles on all servers;
• requires you to reconfigure everything.

danger

This action is irreversible. All your access is revoked immediately.

🔑 Authenticate (/auth)

The /auth command allows you to authenticate to obtain a protected role.

Use the command: /auth [role]

Authentication process

1. Run the /auth command on the server, or click "Take a role" in a staff panel.
2. A menu displays the available roles with their required grade and session duration.
3. Select one or more roles (up to 10). A single authentication, at the level of the most demanding one, opens them all.
4. Choose an authentication method from those that reach the role's grade.
5. Complete the verification (PIN, OTP or passkey).
6. On success, we assign you the Discord role or roles and create a session for each. The sessions are recorded in the Authentication Manager logs.

info

Only roles you are assigned to with the Active status appear in the menu.

Session management

The /auth panel lists your active sessions. For each one, you can:

• Extend session: authenticate again to start over with a full duration.
• Disconnect: the session is revoked immediately and the Discord role removed.

Security

• Warning: a warning message appears starting from 3 failed attempts.
• Lockout: after 5 failures, your account is locked for 1 hour.
• Reset: after 10 failures, your account is reset and all your access is revoked.

⚙️ Server configuration

The Authentification Manager configuration panel opens in two ways:

1. Run the /settings command.
2. Open the "Protection" tab.
3. Click "Configure" next to "Authentification Manager".

The panel then replaces the dashboard, with a "Back" button to return to the Protection tab. You can also directly use the /auth-settings command, which opens the same panel.

Authentification Manager

---

Server configuration Default Session Time : 10m
Default Minimum Grade :
Min Managers Grade :
Webhook : not set

---

@Administrateur • 30m • 2 users

@Modérateur • 60m • 3 users

Empty slot

Empty slot

Empty slot

info

The /auth-settings command is reserved for administrators by default. For a non-administrator manager to be able to use it, allow it for them in Server Settings > Integrations > RaidProtect.

Permissions

Role	Access
Owner	Full access
Administrator	Full access (unless the Administrator permission comes from a role protected by AM)
Manager	Limited access: must authenticate, only manages the roles and users below them, cannot change the server configuration

Manager authentication

A manager who is neither owner nor administrator must authenticate every time they open the panel. We offer them the methods that reach the minimum manager grade: "Authenticate with PIN", "Authenticate with OTP" or "Authenticate with Passkey". The reinforced PIN is entered on the shuffled-key keypad.

The same protections as for /auth apply: warning from 3 failures, one-hour lockout at 5 failures, account reset at 10 failures.

Server settings

Click "Edit" next to "Server Configuration" to open the "Server Authentication Configuration" window:

• Default Session Time: duration offered for new roles, in the format 30m, 2h or 1d. Up to 8 hours in the free version, 24 hours in the premium version. Default: 10 minutes.
• Default Minimum Grade: grade offered for new roles. Default: A.
• Min Managers Grade: grade a manager must reach to open the panel. Default: A.
• Webhook URL (leave empty to clear): Discord webhook that receives the AM logs (optional). Only Discord webhook URLs are accepted.

Managers cannot change these settings.

Roles tab

The Roles tab lists your protected roles with their grade, session duration and number of users. Below the tabs, the "Last sessions" block shows the most recent one, and "View all" opens the list of all sessions.

info

Limits: 3 roles in the free version, 10 roles in the premium version. Disabled roles still occupy a slot.

Add a role

1. Open the Authentification Manager panel (see above).
2. In the "Roles" tab, click "Add".
3. Choose the Discord role to protect.
4. Choose the minimum security grade.
5. Enter the session duration.
6. Choose an integration strategy (see below).
7. We detect the members who already have this role: adjust the selection, then click "Send invitations" (or "Skip").

Each chosen member is attached to the role with the Active status if their grade is sufficient, otherwise Invited: they then receive a DM inviting them to set up /auth-profile.

Add Authentication Role

Discord Role

Sélectionner un rôle

Minimum Security Grade

OTP required

Session duration (max. 8h)

10m

Choose a strategy

Use this role as-is

We refuse a role managed by an integration, a role used in Discord's Onboarding Process, a role above RaidProtect's role or above yours, and a role that is already protected.

Integration strategies

Strategy	Effect
"Use this role as-is"	The chosen role directly becomes the protected role. This is the default choice.
"Create a separate permissions role"	We create a 🔑 <role name> role with the original permissions, just below the chosen role, and empty the original role's permissions. The original role permanently keeps its color and display, the new role is the one that is protected.

tip

If your role is displayed separately in the member list, choose "Create a separate permissions role": your members keep their visible role permanently, and the sensitive permissions are only granted during authenticated sessions.

With a separate role, the channel moderation permissions of the display role also move to the 🔑 role. For an administrator role, the "Keep view of all channels outside sessions" option leaves the display role able to view all channels outside sessions; without it, it no longer sees anything without the administrator permission.

Protect administrator roles from /audit

The audit's administrator roles check offers "Integrate all": you protect in one go the administrator roles that are not yet protected, 5 roles at most per batch and within your free slots. Only roles below RaidProtect and below your highest role are offered.

Edit a role

Click "Edit" on the role's row to open its sheet (minimum grade, session duration, assigned users), then "Edit" to change the minimum grade and the session duration.

Enable / Disable a role

From the role's sheet, "Disable" pauses the role without deleting it: no session is created for it anymore. Ongoing sessions are revoked and the Discord role is removed from the members concerned. "Enable" puts it back in service, within your slots.

Delete a role

"Delete" permanently removes the role from the Authentification Manager, along with all user assignments. You are asked for confirmation.

Users tab

The Users tab lists the members attached to at least one protected role, with their grade, number of roles and manager status.

info

Limits: 20 users in the free version, 50 in the premium version.

Add a user

1. Open the "Users" tab.
2. Click "Add".
3. Choose the user and the Authentication role to assign to them.

The member receives a DM: they can use the role right away if their grade is sufficient, otherwise they are invited to set up a method of sufficient grade.

info

Invitations are limited to prevent spam. Blocked ones can be resent later from the member's sheet.

User sheet and statuses

Click "Manage" to open a member's sheet: their grade, their ID, whether they are a manager, and each of their roles with its status. The role selector lets you add or remove some.

Status	Description
Invited	The member has been added but their grade is not yet sufficient (profile to set up)
Pending	Awaiting approval: click "Approve"
Active	The member can authenticate to obtain the role
Disabled	Access is suspended: click "Restore" to reinstate it

Promote to manager

"Make Manager" gives the member access to the configuration panel, provided they reach the minimum manager grade. A manager manages the users and roles below them. "Remove Manager" removes this access.

Delete a user

"Delete User" removes the member from all protected roles on the server. You are asked for confirmation.

Logs tab

The Logs tab shows the Authentification Manager's log, paginated: sessions granted, extended or revoked, configuration changes... The eye-shaped button opens an entry's details (user, action, type, date, role and target). Logs are also sent to the configured webhook.

Sessions

There is no dedicated tab: the "Last sessions" block of the Roles tab shows the most recent session, and "View all" opens the list of all the server's sessions with their status (Active, Expired, Revoked). "View" shows a session's details and its latest actions.

Onboarding Process protection

If a protected role is added to the questions of Discord's Onboarding Process, we automatically remove it from the question and record it in the logs: otherwise, any newcomer could obtain the role without authenticating.

End of Premium

When a Premium subscription ends, active roles beyond 3 are automatically disabled (the oldest are kept) and session durations over 8 hours are brought down to 8 hours.

Frequently asked questions

Which authentication methods are available?

There are three methods: the PIN code (simple or reinforced), OTP (a 2FA code following the TOTP standard) and passkeys (WebAuthn). Passkeys offer the highest level of security (grade S).

Where do I configure the Authentification Manager?

In /settings, Protection tab, by clicking "Configure" next to "Authentification Manager", or directly with the /auth-settings command.

What happens when a session expires?

The protected role is automatically removed from the member. They must re-authenticate via /auth to obtain it again, or extend their session before it expires.

What if I forget my credentials?

From your /auth-profile, the "I forgot my auths" button fully resets your account: all your methods are deleted and your access is revoked. This action is irreversible and requires a complete reconfiguration.

How many roles can I protect with the Authentification Manager?

You can protect 3 roles in the free version and 10 roles in the premium version, for 20 and 50 users respectively. Sessions last at most 8 hours in the free version and 24 hours in the premium version.

Can a manager change everything?

No. A manager must authenticate every time they open the panel, only manages the roles and users below them, and cannot change the server configuration.