For Developers · Discord Bot
PandaAuth Core Bot
Invite one bot, link your service, and your Discord server becomes a whitelist dashboard — key delivery, redemption, HWID resets, buyer roles and an audit trail, without your buyers ever leaving Discord.
What it does
PandaAuth Core is the official Discord bot for Panda Key System. It is multi-tenant: the same bot serves every developer. You invite it, run /login, pick which of your services this server sells, and everything the bot does from then on happens against that service through the public API.
- Members press buttons on a panel — Get Key, Redeem, Get Script, Reset HWID, My Stats, Get Role — or use the equivalent slash commands.
- You whitelist, blacklist, compensate, bulk-generate keys and inspect members without opening the dashboard.
- Nothing is duplicated. Keys, HWIDs and expiries stay in Panda Key System. The bot only stores which server is linked to which service, its panels and its settings.
Multiple products in one server
A server is not limited to a single service. Run /login again to link a second one, then post a separate panel for each with /setpanel. Every command takes an optional service option (with autocomplete) and falls back to the default service you set with /select-service.
Requirements
- A Panda Key System service that is active. Its API key is what the bot stores.
- Manage Server permission, or the manager role set with
/settings roles, to run any management command. - For the buyer role to work, the bot needs Manage Roles and its own role must sit above the buyer role in Server Settings → Roles.
- For
/scriptto return anything, at least one script must be marked Discord-visible in your dashboard.
Permissions the bot asks for
- View Channel, Send Messages, Embed Links, Read Message History — posting and updating panels.
- Attach Files — delivering
/mass-generatekey files. - Manage Roles — granting and removing the buyer role.
- Manage Messages — cleaning up panels deleted with
/panels delete.
Per-command permissions are Discord's, not ours
Privacy
- Every reply the bot sends is ephemeral — only the person who ran the command sees it. Keys are never posted publicly.
- Passwords and license keys are collected in modals, never as slash-command options, because Discord displays command arguments in the channel.
- Your service API key is encrypted at rest by the bot and is never shown in any reply.
Where to go next
- Set Up the Bot — invite, link a service, configure roles, post a panel.
- Command Reference — every command, option and permission.
- Member Panel — what each button does and what members see.
- Troubleshooting — what each error message means.