What you can build
| Capability | Summary |
|---|---|
| Applications & bots | Register an application, get a bot identity, and install it into servers with explicit permissions. |
| Scoped tokens | Bot and access tokens are scoped and hashed at rest; they are revoked atomically on suspension. |
| OAuth 2.0 | Let users authorize your app with least-privilege scopes via standard OAuth2. |
| Realtime gateway | Subscribe to events over the WebSocket gateway; payloads are validated and rate-limited. |
| Marketplace | Publish bots, themes, role packs, AI personas, and security policies to the in-app marketplace. |
Safety model for integrations
- Least privilege: tokens carry only the scopes granted; server installs require explicit permissions.
- Tokens are hashed at rest and rotated; nothing sensitive is exposed to the client.
- Bot and user actions pass the same security policies and rate limits as everyone else.
