One service token. Explicitly connected channels.

Pilot authentication is deliberately operator-issued. The bearer token authenticates TRENBot as the client; verified Discord context resolves the account owner who explicitly connected that channel.

Send the bearer credential

Required header

Authorization: Bearer <pilot-token>

The token must contain at least 32 bytes. Paggered compares a digest of the presented token in constant time before it creates a service-role database client or runs an account query.

Send verified channel context

Required TRENBot headers

X-Paggered-Platform: discord
X-Paggered-Platform-User-Id: <command-caller-id>
X-Paggered-Guild-Id: <discord-guild-id>
X-Paggered-Channel-Id: <discord-channel-id>

Paggered resolves these opaque platform identifiers after bearer authentication. The bearer token does not identify the Paggered account. The client never sends a Paggered username or internal user ID, and an unconnected or revoked channel fails with connection_required.

How account owners authenticate

A Discord administrator runs /pags connect. The account owner signs into Paggered, separately consents to public channel sharing, and verifies the same Discord identity that started the command. The short-lived Discord access token is used only for that identity check and is not retained. Connections can be revoked in Paggered Settings.

Keep it out of the browser

Store it as a server-side secret in Paggered and TRENBot.
Never use a variable prefixed with NEXT_PUBLIC_.
Never place it in Discord, Twitch, logs, analytics, prompts, facts, or conversation memory.
Rotate it by updating both services, validating the new value, then revoking the old one.

Authentication responses

404not_found

The API is disabled or its server configuration is invalid.

401invalid_token

The bearer header is missing or the token does not match.

403connection_required

The authenticated channel is not connected or has been revoked.

429rate_limited

The 30-per-minute claim failed. Honour the Retry-After header.

Stable error envelope

{
  "error": {
    "code": "invalid_token",
    "message": "Invalid bearer token.",
    "request_id": "0f693266-1957-4f47-9bd2-65718bed42f3"
  }
}