GameGrid Discord Bot

What it is

What it does

Setup, in order

About five minutes. Steps 1 to 3 are required; the rest is how you make it pleasant to use.

1. Add the bot to your Discord server with the Add to Discord button. You need the Manage Server permission in that Discord to invite it.
2. Create a GameGrid API key at your account’s API Keys page. Keys start with gsk_ and are shown once. Give it the scopes you want the bot to be able to use — that choice is the ceiling on everything below.
3. Run /setup in Discord and paste the key. The bot verifies it against the Customer API, records which scopes it carries, and stores it encrypted. Only the member who runs this and the Discord server owner can change the bot’s configuration afterwards.
4. Hand out abilities with /permissions. Every role starts able to do nothing. /permissions preset gives a role a ready-made set, then /permissions grant and /permissions revoke adjust it one ability at a time. /permissions catalogue lists everything that can be granted, and /permissions key shows what your API key will actually allow.
5. Point it at a server. /config default-server sets one default, or /config channel-server binds individual channels to individual servers so commands in them need no server ID.
6. Choose your channels. /config log-channel for an audit trail of what the bot did, /config alert-channel for start, stop and crash notices, /config command-channel to confine console commands to one room, and /config timezone so scheduled times read the way your community reads them.
7. Run your first command. /servers lists what you have, /status reports live stats, and /help prints every command with what you personally can run at the top.

Guilds set up before the ability model still work: /config role assigns the older permission levels, and each level resolves to exactly the abilities that level could use. /permissions is the way to configure a role now, and the first grant on a role converts it from a level to an explicit list.

Who in your Discord can do what

You define the tiers. The bot ships 55 named abilities; you map them onto the Discord roles you already have, so “owner”, “moderator” and “customer” mean whatever they mean in your community.

Start from a preset, then adjust

A preset is a starting point, not a ceiling. It is stored as the literal list of abilities it contained the moment you applied it, so a role given moderator last month does not silently gain a new ability the bot ships tomorrow. There is deliberately no wildcard preset and no wildcard ability.

The 55 abilities

Each one is granted by name — /permissions grant with the role and the ability — and each command requires exactly one. Run /permissions catalogue in Discord to read all of them with their descriptions.

• Servers7
• Settings2
• Console & logs3
• Players & files3
• In-game2
• Metrics6
• Backups4
• Mods2
• Windrose Plus2
• Events & presets3
• Scheduled commands3
• Economy7
• Economy admin6
• Chat bridge1
• Account & billing3
• Bot administration1

Three rules worth knowing before you start

Delegating it

Handing out abilities is itself an ability. Granting bot.permissions.manage to a role lets your head admin configure who can do what without ever touching your API key — and it cannot lift the ceiling, so they still cannot grant something the key will not back. Anyone can run /permissions me to see what they personally can do, and it replies privately.

Commands (52)

52 top-level commands, 173 including subcommands. The ability column is the exact name you type into /permissions grant.

Security

• Your API key is encrypted with AES-256-GCM before it is stored, is never echoed back into Discord, and is never written to a log. It is decrypted in memory only for the moment it is used.
• Only the member who ran /setup and the Discord server owner can change configuration. That check runs inside the bot, so a Discord Administrator who is neither is still refused.
• Every role starts with nothing. Abilities are granted per role with /permissions grant, and a member gets the union of what their roles grant — a role never takes away what another role gave.
• Of the 55 abilities, the ones that stop a server, overwrite data, change configuration or spend currency are marked as destructive, excluded from every preset below moderator, and never granted to @everyone.
• Start, stop and restart are three separate abilities, as are listing, creating, restoring and deleting a backup. Console commands can additionally be confined to one channel with /config command-channel.
• A Discord role can only ever grant a subset of what your GameGrid API key allows. There is no wildcard ability and no wildcard preset, so a grant cannot silently widen as the bot grows.
• Every request goes through the same Customer API the web panel uses, signed with your key — the bot cannot reach anything that key is not scoped for.
• /account, /billing, /tickets and /ticket reply privately, and their abilities sit in the admin preset only.
• /config reset deletes the stored key and all configuration for that Discord server.

Questions people ask before inviting it

Do I need to host the Discord bot myself?

No. It is a single public bot run by GameGrid. You invite it with the Add to Discord button and link your API key; there is nothing to install or keep running.

What does the bot cost?

Nothing. It is included for GameGrid customers and needs no separate account — it authenticates as you, using a GameGrid API key you create in your account.

What Discord permissions does it ask for?

Four: View Channel, Send Messages, Embed Links, and Use Application Commands. It does not ask to read message history, manage messages, mention everyone, kick, ban, or manage roles.

Can other people in my Discord control my servers?

Only if you let them. Every Discord role starts able to do nothing. You give a role specific abilities with /permissions grant — restart a server, read the console, buy from the shop — or start from one of five presets (nothing, member, operator, moderator, admin) and adjust from there. A member holding several roles can do everything those roles grant between them. Destructive abilities are refused outright for @everyone, so one wrong pick cannot hand server control — or your billing — to the whole Discord. And a Discord role can only ever grant a subset of what your GameGrid API key already allows, never more.

Do my players need a GameGrid account to use it?

No. Everything the bot does runs on the one API key you linked with /setup. A player only needs to be in your Discord and hold a role you have given bot abilities to. Running /link connects their Discord account to their in-game character so the shop and kits know where to deliver.

What happens if my API key does not allow something?

The bot refuses locally and tells you the key is the reason, naming the scope that is missing, instead of sending a request the Customer API would answer with an opaque error. Run /permissions key to see every ability the key can and cannot back. To raise that ceiling you mint a broader key and re-run /setup.

Does anyone at GameGrid have access through the bot?

One account does: the operator account the bot runs under. It is our support path into the bot, it is not something a customer can set, and every command it runs is written to your log channel if you have set one with /config log-channel.

Who can change the bot configuration after setup?

Only the member who ran /setup and the Discord server owner. That check is in the bot itself, so a Discord Administrator who is neither of those is still refused. Handing out bot abilities can be delegated separately, with the bot.permissions.manage ability, without giving anyone your API key.

Where is my API key stored, and can anyone see it?

It is encrypted with AES-256-GCM and kept in the bot's own database. It is never echoed back into Discord, never written to a log, and is decrypted in memory only for the moment it is used to call the API.

Will my billing or account details appear in the channel?

No. /account, /billing, /tickets and /ticket reply privately to you — nobody else in the channel sees them.

Documentation