Understanding bot permissions

Why that list appears at all

When you invite a bot, Discord shows you a list of checkboxes. Most people skim it and press "Authorize". That is understandable — the list is long, the terms are technical, and you want the bot to work.

Except that list is the only moment in which you decide what somebody else's program may do on your server. Nobody asks again afterwards.

This guide explains what the important permissions actually mean, which ones get dangerous in combination, and how to inspect an invite without reading Discord's documentation.

The one that cancels everything else

Administrator is not one permission among many. It contains every other one, now and in future, and it overrides channel-level settings. A bot with Administrator can delete channels, hand out roles, ban every member and rename the server — regardless of what you configured per channel.

This is not theoretical. The server takeovers people write about in community forums almost always run through a bot with Administrator whose token turned up somewhere. The attacker does not need to attack your server; they simply use the bot.

There are cases where it can be justified — an anti-nuke bot has to outrank everyone. But the question is not "can this be justified", it is "did anybody justify it". A bot that requests Administrator without explaining why in its description has not answered the question.

The four worth a second thought

Manage Roles sounds harmless and is the second half of almost every takeover. Discord does constrain it: a bot can only assign roles positioned below its own. Which is exactly why the position of the bot's role decides how much damage is possible. Drag it as far down as the feature allows.

Manage Channels also means deleting channels. All of them, not only its own. A ticket bot needs this; a music bot does not.

Manage Webhooks allows sending messages under someone else's name and avatar. For a notification bot that is a sensible route, because webhook messages do not consume the bot's own rate limit. For anything else it is a way to impersonate.

Manage Messages means deleting and pinning — necessary for moderation, questionable for a game bot.

How to inspect an invite before opening it

Every invite URL carries the requested permissions as a number:

https://discord.com/oauth2/authorize?client_id=123456789&permissions=8&scope=bot

permissions=8 is Administrator. Eight is the third bit, and it is the one number worth memorising. permissions=0 requests nothing at all — the bot then gets whatever the @everyone role already has.

For any other number, use the calculator in Discord's developer portal, or more conveniently the breakdown we render on every bot page. We decode the number into plain language and flag what carries risk.

The second value that matters is scope. bot is normal. applications.commands enables slash commands and is standard today. Anything beyond those two deserves a question.

The practical rule

Compare the permissions against what the bot promises. A music bot needs Connect and Speak. A poll bot needs Send Messages. When the list is considerably longer than the feature set, there are two possibilities: the developer could not be bothered to narrow it down, or the bot does more than the description says. Either is a reason to keep looking.

And if you got it wrong once: permissions can be changed afterwards. Server Settings → Roles → the bot's role. What you remove there stays removed, even if the invite asked for more.