[Feature Request] applicationManager.GetOAuth2Token should allow for different scopes.
In https://discord.com/developers/docs/game-sdk/applications#getoauth2token The function does not expose a parameter to add desired scopes to it, instead we are stuck with just the 'identify' scope statically put there.
As a Discord Game Dev, it would streamline the code for us to allow to edit scopes in the GameSDK OAuth2 code flow so it can be close as that of a custom OAuth2 Flow as possible, but simplified!
The only serious issue/blocker for this is that the getOAuth2Token function just pulls from the env var Discord injects into games launched via the Library, which is limited in scope for a reason [security, not giving too much info up in case malware steals env vars, etc].
Your best bet for getting more scopes is to:
- have the user log in to your website via Discord (once, since you can store refresh tokens)
- when your game starts up, send the
GetOAuth2Token-provided token to your own web server -
- use the
users/@meendpoint to obtain the user's ID
- use the
-
- cross-reference that with your database to locate your refresh token and call differently-scoped APIs.
My game is almost never started from Discord, so when the oauth token is missing there is a user prompt invoked in Discord to accept it, in the same way as a browser would prompt.
Doesn't that mean that the SDK is doing a bit more than just fetching an ENV var, and has to instead create some kind of oauth URL for Discord?
If thats the case, then perhaps Discord actually already supports scopes in the same way that the URL method does. Add scopes as an option to GetOAuth2Token, and if a scopes argument is provided then force an oauth prompt in the Discord - it'll then be the application's responsibility to retain the token for later instead of the presence of the environment variable, and the function would still work as current if the scopes argument isn't present.