diff --git a/docs/discord-social-sdk/development-guides/account-linking-with-discord.mdx b/docs/discord-social-sdk/development-guides/account-linking-with-discord.mdx
index ae5b12799c..e45eab82cd 100644
--- a/docs/discord-social-sdk/development-guides/account-linking-with-discord.mdx
+++ b/docs/discord-social-sdk/development-guides/account-linking-with-discord.mdx
@@ -106,8 +106,6 @@ Once the user approves the request from Step 2, Discord will redirect the user b
### Step 4: Exchanging the Authorization Code for an Access Token
-#### Token Exchange for Public Clients
-
#### Server-to-Server Get Token Exchange
If your application uses a backend server and does **not** have `Public Client` enabled, you can manually exchange the authorization code for an access token using the Discord API.
@@ -143,6 +141,8 @@ def exchange_code(code, redirect_uri):
}
```
+#### Token Exchange for Public Clients
+
If your app does not have a backend server, enable `Public Client` in the Discord Developer Portal and use [`Client::GetToken`] to automatically exchange the authorization code for a token.
@@ -182,6 +182,28 @@ client->UpdateToken(discordpp::AuthorizationTokenType::Bearer, ACCESS_TOKEN_VALU
Access tokens expire after 7 days, requiring refresh tokens to get a new one.
+### Server-to-Server Token Refresh
+
+If you're handling authentication on your server, send an API request to refresh the token.
+
+```python
+import requests
+
+API_ENDPOINT = 'https://discord.com/api/v10'
+CLIENT_ID = 'YOUR_CLIENT_ID'
+CLIENT_SECRET = 'YOUR_CLIENT_SECRET'
+
+def refresh_token(refresh_token):
+ data = {
+ 'grant_type': 'refresh_token',
+ 'refresh_token': refresh_token
+ }
+ headers = {'Content-Type': 'application/x-www-form-urlencoded'}
+ r = requests.post(f'{API_ENDPOINT}/oauth2/token', data=data, headers=headers, auth=(CLIENT_ID, CLIENT_SECRET))
+ r.raise_for_status()
+ return r.json()
+```
+
### Refreshing Access Tokens for Public Clients
@@ -206,9 +228,19 @@ client->RefreshToken(
});
```
-### Server-to-Server Token Refresh
+---
-If you're handling authentication on your server, send an API request to refresh the token.
+## Revoking Access Tokens
+
+If a user wants to disconnect their Discord account or if a token is compromised, you can revoke access and refresh tokens.
+
+:::warn
+When any valid access or refresh token is revoked, all of your application's access and refresh tokens for that user are immediately invalidated.
+:::
+
+### Server-to-Server Token Revocation
+
+If your application uses a backend server, you can revoke tokens by making an API request to Discord's token revocation endpoint.
```python
import requests
@@ -217,27 +249,13 @@ API_ENDPOINT = 'https://discord.com/api/v10'
CLIENT_ID = 'YOUR_CLIENT_ID'
CLIENT_SECRET = 'YOUR_CLIENT_SECRET'
-def refresh_token(refresh_token):
- data = {
- 'grant_type': 'refresh_token',
- 'refresh_token': refresh_token
- }
+def revoke_token(access_or_refresh_token):
+ data = {'token': access_or_refresh_token}
headers = {'Content-Type': 'application/x-www-form-urlencoded'}
r = requests.post(f'{API_ENDPOINT}/oauth2/token', data=data, headers=headers, auth=(CLIENT_ID, CLIENT_SECRET))
r.raise_for_status()
- return r.json()
```
----
-
-## Revoking Access Tokens
-
-If a user wants to disconnect their Discord account or if a token is compromised, you can revoke access and refresh tokens.
-
-:::warn
-When any valid access or refresh token is revoked, all of your application's access and refresh tokens for that user are immediately invalidated.
-:::
-
### Revoking Access Tokens for Public Clients
@@ -263,24 +281,6 @@ client->RevokeToken(YOUR_DISCORD_APPLICATION_ID,
});
```
-### Server-to-Server Token Revocation
-
-If your application uses a backend server, you can revoke tokens by making an API request to Discord's token revocation endpoint.
-
-```python
-import requests
-
-API_ENDPOINT = 'https://discord.com/api/v10'
-CLIENT_ID = 'YOUR_CLIENT_ID'
-CLIENT_SECRET = 'YOUR_CLIENT_SECRET'
-
-def revoke_token(access_or_refresh_token):
- data = {'token': access_or_refresh_token}
- headers = {'Content-Type': 'application/x-www-form-urlencoded'}
- r = requests.post(f'{API_ENDPOINT}/oauth2/token', data=data, headers=headers, auth=(CLIENT_ID, CLIENT_SECRET))
- r.raise_for_status()
-```
-
### Handling User Initiated Revocation
Users can unlink their account by removing access to your application on their Discord `User Settings -> Authorized Apps` page.