Verification

Verification

Confirm member identity with Discord OAuth2 and multi-layer security checks. Understand the complete verification flow, every security check, data collection, customization options, and widget mode.

Overview

Verification is the core feature of Restore Hub. When a member wants to join your server, they visit your verification page, authorize with Discord, pass security checks, and receive the verified role. The entire flow takes seconds for legitimate users while blocking bots, alts, VPN users, and other threats.

The verification flow can be triggered from two sources: a Discord server (the standard flow where members click a link in your server) or a website widget (an embeddable JavaScript widget for external sites). Both flows use the same security pipeline.

The Complete Verification Flow

Here is the exact order of operations when a member clicks your verification link. Each step happens sequentially — if any check fails, the flow stops and the member sees a block/error message.

1. Page load — session created — The member visits your verification URL (restorehub.net/s/your-slug or verify.yourdomain.com). RestoreHub creates a unique session ID and records a page view event with their IP, user agent, device type, OS, country, and referrer URL.

2. Pre-OAuth check 1 — Whitelist — If the server has any whitelist rules (IP, user ID, fingerprint, country, ASN), Restore Hub checks if the visitor matches any. Whitelisted visitors bypass ALL subsequent security checks and proceed directly to OAuth2.

3. Pre-OAuth check 2 — Firewall — If the firewall is enabled (Premium+), Restore Hub checks the visitor's IP, country, ASN, browser fingerprint, and other attributes against all firewall rules. If any rule matches, the visitor is blocked immediately.

4. Pre-OAuth check 3 — Country restrictions — If the server has allowed or blocked countries configured, the visitor's country (derived from IP geolocation) is checked. You can operate in allow mode (only listed countries can verify) or block mode (listed countries are denied).

5. Pre-OAuth check 4 — VPN/Proxy/Tor/Datacenter detection — If VPN blocking is enabled (Premium+), the visitor's IP is checked against Restore Hub's in-house IP intelligence database. This covers VPN exit nodes, proxy servers, Tor exit nodes, datacenter/hosting IPs, and bogon ranges. No external API calls are made — all data is local.

6. Pre-OAuth check 5 — Captcha — If captcha is enabled, the visitor must solve a Cloudflare Turnstile challenge (invisible or managed) before proceeding. This happens before OAuth2 to prevent bots from hitting the Discord authorization page.

7. OAuth2 redirect — The visitor clicks the "Verify" button and is redirected to Discord's OAuth2 authorization page. The requested scopes are: identify (user ID, username, avatar), email (email address), guilds (list of servers they are in), and guilds.join (ability to add them to a server).

8. OAuth2 consent & callback — The member authorizes the application. Discord redirects them back to Restore Hub's callback URL with an authorization code. Restore Hub exchanges the code for access and refresh tokens, then fetches the member's Discord profile, email, and guild list.

9. Post-OAuth check 1 — Blacklist — The member's Discord user ID is checked against your personal blacklist. If they are blacklisted, verification is rejected.

10. Post-OAuth check 2 — Account age — If a minimum account age is set (e.g., 30 days), Restore Hub extracts the account creation date from the Discord user ID snowflake and checks if the account is old enough.

11. Post-OAuth check 3 — Alt detection — If alt detection is enabled (Premium+), Restore Hub compares the member's browser fingerprint (canvas, WebGL, audio context, device specs) against all previously verified members across your servers. If a matching fingerprint is found under a different Discord user ID, it is flagged as a potential alt account.

12. Role assignment — All checks passed. Restore Hub uses the guilds.join OAuth2 scope to add the member to the server (if not already in it) and assigns the configured verified role using the bot's REST API. The member is now verified.

13. Data storage — The member's Discord data, OAuth2 tokens (encrypted), network metadata, device metadata, and browser fingerprints are stored. Tokens enable future pulling. All sensitive fields (IP, email, tokens) are encrypted at rest.

Security Checks — Detailed Reference

| Check | When | Plan | Configurable |
|---|---|---|---|
| Whitelist bypass | Pre-OAuth (1st) | Premium+ | Yes — add rules by IP, user ID, fingerprint, country, ASN |
| Firewall rules | Pre-OAuth (2nd) | Premium+ | Yes — 7 rule types (IP, Country, ASN, Fingerprint, User ID, Server ID, Region) |
| Country restrictions | Pre-OAuth (3rd) | All | Yes — allow mode or block mode with ISO country codes |
| VPN/Proxy detection | Pre-OAuth (4th) | Premium+ | Toggle on/off; separate toggles for Tor and datacenter blocking |
| Captcha | Pre-OAuth (5th) | All | Choose None or Cloudflare Turnstile |
| Blacklist | Post-OAuth (1st) | All | Managed via dashboard or /blacklist command |
| Account age | Post-OAuth (2nd) | All | Set minimum age in days (0 = disabled) |
| Alt detection | Post-OAuth (3rd) | Premium+ | Toggle on/off; configurable action (block, flag, notify) |

OAuth2 Scopes & What They Enable

When a member authorizes through Discord OAuth2, Restore Hub requests four scopes. Each scope enables specific functionality:

| Scope | Grants Access To | Why Restore Hub Needs It |
|---|---|---|
| identify | User ID, username, display name, avatar, banner, accent color, locale, MFA status, premium type, public flags | Core identity verification — knowing who the member is |
| email | Email address and whether it is verified | Alt detection correlation, contact for alerts, data enrichment |
| guilds | List of all servers the member is in (ID, name, icon, owner flag, permissions) | Server ID-based firewall rules, cross-server analytics, marketplace validation |
| guilds.join | Ability to add the member to a server on their behalf | Adding members to target servers during pulls and marketplace order fulfillment |

Tip: The guilds.join scope is what makes member pulling possible. When a member verifies, they consent to being added to servers. Restore Hub stores the OAuth2 token (encrypted) and uses it later when you initiate a pull.

Data Collected During Verification

Restore Hub collects comprehensive data during verification to power security features, analytics, and intelligence. Here is a full breakdown of every data point:

• Discord profile: user ID, username, display name, avatar hash, banner hash, accent color, locale, premium/Nitro type (none, classic, nitro, basic), public flags (badges), MFA status, account creation date (from snowflake), verified email flag, verified phone flag

• Email: email address (encrypted at rest), verification status

• Guilds: array of guild objects the member is in (used for Server ID firewall rules and cross-server intelligence)

• OAuth2 tokens: access token and refresh token (both encrypted), token expiry timestamp

• Network: IP address (encrypted), country code, region code, city, ASN, ISP name, VPN flag, proxy flag, Tor flag, datacenter flag, cellular flag

• Device: user agent string, device type (desktop/mobile/tablet), operating system, screen resolution, language, timezone

• Hardware: CPU core count (hardwareConcurrency), device memory (GB), GPU vendor (WebGL UNMASKED_VENDOR), GPU renderer (WebGL UNMASKED_RENDERER), color depth, touch support

• Browser: cookies enabled, Do Not Track flag, plugin count, detected font count, connection type (4g/3g/2g), connection downlink speed (Mbps)

• Fingerprints: composite browser fingerprint hash, individual canvas fingerprint hash, WebGL fingerprint hash, AudioContext fingerprint hash

• Referrer: the URL that referred the member to the verification page (if any)

Warning: All personally identifiable information (IP addresses, email addresses, OAuth2 tokens) is encrypted at rest using AES-256. On Premium+ plans, server owners can view detailed member data in the member detail page. On the Free plan, only basic Discord profile info is visible.

Custom Verification Pages

Every server gets a customizable verification page. You can brand it to match your community's identity. All customization options are configured in the server settings under "Verify Page" or via the VerifyPageConfig JSON object.

| Option | Description |
|---|---|
| Profile Image | A square image displayed above the verify button (your community logo) |
| Banner Image | A wide image at the top of the page |
| Banner Video | A video that plays in the banner area (MP4/WebM URL) |
| Background Color | A solid color for the page background (hex code) |
| Background Image | A full-page background image URL |
| Background Video | A full-page looping background video (MP4/WebM URL) |
| Font Family | Google Fonts name (e.g., "Inter", "Poppins", "JetBrains Mono") |
| Text Color | Hex color for all text on the page |
| Button Color | Solid hex color for the verify button |
| Button Gradient | CSS gradient string for the verify button (overrides solid color) |
| Custom CSS | Raw CSS injected into the page for advanced customization |
| Social Links | Array of {platform, url} objects rendered as icons below the verify button |
| Success Message | Custom message shown after successful verification |
| Error Message | Custom message shown when verification fails |
| Blocked Message | Custom message shown when a member is blocked by security checks |
| Custom Cursor | URL to a custom cursor image |
| Music URL | URL to background audio that plays on the verification page |

Tip: You can preview your custom verify page in the dashboard before making it live. Use the "Preview" button in server settings.

Widget Mode — Verification on Your Website

Beyond the standard Discord-based verification flow, Restore Hub offers a JavaScript widget that you can embed on any website. This enables Discord SSO (Single Sign-On) on your own site — members verify through your site and get a role in your Discord server.

Widget mode uses the same security pipeline (firewall, VPN detection, captcha, alt detection) as standard verification. The only difference is where the member starts the flow.

1. Enable the widget — In server settings, go to the Widget tab and toggle it on.

2. Configure allowed origins — Add the domains where the widget will be embedded (e.g., https://yoursite.com). This prevents the widget from being used on unauthorized sites.

3. Customize the button — Set the button text (default: "Login with Discord"), button color, and text color.

4. Embed the script — Copy the provided <script> tag and paste it into your website's HTML. The widget renders a button that triggers the Discord OAuth2 flow in a popup.

npm install @restorehub/widget

import { verify } from "@restorehub/widget";
const result = await verify("your-server-slug");

Verification URLs

Members access your verification page through one of two URL formats:

• Slug URL: restorehub.net/s/your-community — Instant setup, no DNS required. Slug must be lowercase letters, numbers, and hyphens only.

• Custom domain: verify.yourdomain.com — Requires a CNAME record pointing to cname.restorehub.net. Available on Business+ plans. Automatic SSL via Let's Encrypt.

Verification Event Statuses

Every verification attempt is tracked through a series of event statuses. These appear in your analytics dashboard and API responses:

| Status | Meaning |
|---|---|
| PAGE_VIEW | Member loaded the verification page |
| STARTED | Member clicked the Verify button |
| CAPTCHA_SHOWN | Captcha challenge was displayed |
| CAPTCHA_PASSED | Member solved the captcha |
| OAUTH_REDIRECT | Member was redirected to Discord OAuth2 |
| COMPLETED | Verification successful — role assigned |
| BLOCKED | Blocked by a security check (blockReason field has details) |
| FAILED | Verification failed due to an error (token exchange failed, API error, etc.) |