Discord ↔ Roblox account verification, done properly.
USMBOT is a Discord bot for Roblox-connected communities. It verifies that a Discord member genuinely owns the Roblox account they claim, using Roblox's official OAuth login — never a password form, never a third-party login page.
What this service is
USMBOT is a Discord bot used by Roblox-connected communities to manage membership, verification, and role assignment. This site — hq.jsglow.name — is its public information, legal, and OAuth verification hub.
Roblox account verification
Confirms a Discord member controls the Roblox account they say they do, using Roblox's own sign-in page — not a form on this site.
Discord integration
Runs as a Discord bot with slash commands. Verified members can be assigned Discord roles that mirror their Roblox group rank.
Community administration
Gives server staff tools to track verification status, group rank mappings, and membership records for the community they run.
How Roblox verification works
Roblox OAuth exists to prove account ownership — nothing more. Here is the exact flow, end to end.
Member runs /roblox user verify in Discord
The bot generates a short-lived, single-use link token and DMs the member a link to start verification.
Member is redirected to Roblox's own authorization page
The member is sent to authorize.roblox.com — a page owned and operated by Roblox, not by us. We never see or handle the member's Roblox password.
Roblox authenticates the user and asks for consent
Roblox confirms the member's identity and shows them exactly what information will be shared, before anything is sent to us.
Roblox redirects back with an authorization code
The browser is sent to our callback endpoint, /oauth/roblox/callback, with a one-time authorization code and a state value we generated. We verify the state before doing anything else, to prevent forged callbacks.
The service exchanges the code for identity information
The authorization code is exchanged, server-side, for the approved identity information — the member's Roblox user ID and username. This exchange never happens in the browser.
Roblox User ID is linked to Discord User ID
The Roblox account is linked to the Discord account that started the request, and (where configured) matching Discord roles are assigned based on the member's Roblox group rank.
What data is actually used
Only what's needed to verify identity and administer a Discord community. Full detail is in the Privacy Policy.
- Discord User ID Used as the primary key linking a member to their verification record.
- Discord username / display name Shown in staff-facing verification and administration tools.
- Roblox User ID The permanent identifier returned by Roblox OAuth; used to confirm the linked account.
- Roblox username / display name Returned by the profile scope; shown alongside the verification record.
- Verification timestamp & status When a member verified, and whether the link is currently active.
- Server / community membership metadata Which Discord server(s) and, where applicable, organizational unit or group a member belongs to.
- Role / rank mappings How a Roblox group rank maps to a Discord role, so sync stays accurate.
- Audit records Who changed what, and when — kept for security and administrative accountability.
Security & privacy overview
HTTPS everywhere
This entire site, and the OAuth callback, are served over HTTPS only. Plain HTTP requests are redirected.
State-validated OAuth
Every OAuth request carries a securely generated, single-use state value that is validated before any callback is processed, to prevent forged or replayed callbacks.
Server-side secrets
The Roblox OAuth client secret and Discord bot token are never exposed to a browser or client application.
No password collection
This service never asks for, sees, or stores a Discord or Roblox password. Authentication happens on Discord's and Roblox's own systems.