Documentation

Connect your application.

Link your users to Discord through the public API, or connect a Minecraft server with an existing integration.

Use the public API

Create a workspace, open Servers in the dashboard, and add an integration with the Custom API (app or service) platform. Save its server ID and one-time secret in your backend environment. “Server” is the dashboard name for an integration, including a web application.

Send a verified account UUID to POST /api/v1/identity/authorize. An unlinked account receives a consent URL. After the user connects Discord, call authorize again to read the access decision and Discord user ID.

Read request examples, responses, and error handling

Install a Minecraft integration

Use Velocity at the edge of a network, or Paper or Fabric for a standalone server. These integrations target Minecraft 1.21.1 and Java 21. Your dashboard generates the server ID and a one-time secret after you create the server record.

Place the JAR in plugins/ or mods/. Start once to generate the configuration, then stop the server and add the API URL, server ID, and secret.

Paper uses plugins/SolusLabs/config.yml, Velocity uses plugins/soluslabs/config.yml, and Fabric uses config/soluslabs.json. Restart and confirm the heartbeat in your dashboard. Standalone Paper and Fabric require online mode to verify account ownership.

Configure the policy

Network policies apply across connected servers. Server credentials are scoped to one server, and a rotated secret invalidates the previous one.

api-url: https://plexsur.net
server-id: srv_your_server_id
server-secret: "your-one-time-server-secret"
cache-authenticated-ttl: 300
failure-mode: closed

Fail-closed is the secure default. A fail-open setting must be chosen explicitly by a workspace administrator.

What users see

The consent page shows the requesting application or server, account ID, workspace, and Discord permission before continuing. The default Plexsur Discord app requests only basic identity through the identify scope. Workspace owners can configure their own app in Settings.

Challenge URLs are single-use and expire after ten minutes by default. Discord returns the user to a Plexsur result page. The user returns to your app or game; your backend checks access again before continuing.

Security model

plexsur.net uses OAuth state validation, HTTP-only sessions, hashed machine credentials, tenant-scoped authorization, and cryptographically random challenge tokens. Discord access tokens are not retained for basic identity linking.

Read the security details