Payment clients are a concept used to prevent fraudulent transactions across Discord. When a client first attempts to make a payment, it generates a UUIDv4 identifier to be used as the purchase token. This token is then persisted by the client and sent along with all future payment requests.
It is mandatory that all purchase requests include this token in the purchase_token field of the request body. The tokens expire after 60 days and must be regenerated.
If Discord detects suspicious activity from a payment client during a transaction, it sends a verification email to the user asking them to authorize the purchase. In the meantime, all purchase requests will fail with a 400 bad request and a 100056 JSON error code:
{
"message":"This client needs to be authorized for purchases. We've sent you an email. Click the link on the email and then retry the purchase.",
"code":100056,
"payment_id":"1434311883015458937"
}
The verification email received will contain a link that redirects to the official Discord client with a verification token present in the URL's fragment (e.g. https://discord.com/authorize-payment#token=Wzg1Mjg5MjI5NzY2MTkwNjk5MywiN3NtVnNGYWlQNFBQTzIrREgya3JhUVJmZXFlclpvY3UvaFRwcVFBckw5Yz0iXQ.Y5ER6Q.IQhdQcfkK_eHLC16CcFZaYqRP_E).
After receiving the token, clients can then send a request to the Verify Purchase Request endpoint to complete the authorization process. If the user has not received a link, clients can choose to resend it.
Upon successful verification, the client will receive a User Payment Client Add Gateway event, which indicates that the purchase can be retried.
Some purchases may require additional authentication before they can be completed. In such cases, the purchase request will fail with a 400 bad request and a 100057 JSON error code:
{
"message":"Confirmation required",
"code":100047,
"payment_id":"1434311883015458937"
}
Depending on the payment gateway used, the error response may also contain a adyen_redirect_url field with a URL that the user must visit to complete the authentication process.
Upon successful authentication, the purchase will be automatically confirmed. The client should not retry the purchase request.