> RestoreCord under the hood: the OAuth2 authorize URL, scopes, IP and visitor ID signals, plan-gated firewall checks and the rate limits at every layer.

Source: https://restorecord.tech

# RestoreCord with the lid off

A verification is three things: a standard Discord OAuth2 grant, one pass through your server's firewall and, later, an add-member call Discord allows because the member said yes. This site opens each part up.

[Follow the callback](https://restorecord.tech/verification-callback)[API reference](https://restorecord.com/docs/api)

## What the callback actually looks at

Four inputs feed the decision. Flip through them to see what each one is and where it comes from.

### One lookup, many answers

The request IP is resolved once per verification. Country, continent, ASN, connection type and anonymity flags from that single answer drive firewall rules, VPN and proxy blocking and the cellular block.

* Country, continent, ASN, IP and CIDR range rules
* ASN blacklisting from Business
* Owners can switch IP logging off; a badge tells members

## Four scopes, and only one is fixed

identify is the only scope every verification asks for. The rest follow switches in your server settings, so the consent screen never asks for more than your rules use.

* guilds.join is what turns a verification into a member backup
* Fewer scopes keep prompt=none, so returning members skip consent
* Members can revoke the app in Discord at any time
[Every scope in detail](https://restorecord.tech/oauth2-scopes)

## Which internals each plan switches on

The engine is the same on every plan. What changes is which signals your firewall is allowed to act on.

|                                   | Free     | Premium   | Business | Enterprise |
| --------------------------------- | -------- | --------- | -------- | ---------- |
| RestoreCord pull cooldown         | None     | None      | None     | None       |
| Delay between pulls               | Fixed    | Range     | Range    | Range      |
| Proxied requests                  |          |           |          |            |
| Captcha                           |          |           |          |            |
| Alt detection (IP and visitor ID) | —        |           |          |            |
| VPN and proxy blocking            | —        |           |          |            |
| ASN blacklist                     | —        | —         |          |            |
| Server-membership rules           | —        | —         |          |            |
| Cellular connection block         | —        | —         | —        |            |
| Minimum account age               | —        | —         | —        |            |
| Webhook logs                      | Advanced | Advanced+ |          |            |

## Rate limits come from two places

Discord limits your bot and RestoreCord's API limits your scripts, and each one answers differently when you push too hard.

### Discord

Verification and pulls

Error 10003

Discord limited the account or the bot

Wait 60 min

Add-member calls

One member per call while pulling

Proxied

### REST API v3

Your scripts and integrations

1. Request accepted  
200
2. Too many requests in a burst  
429 RATE\_LIMITED
3. Client waits for Retry-After  
seconds
4. Single retry succeeds  
200

Got a number instead of a role?

Every denial on the verify page carries a code. See which stage of the callback produced it and who can fix it.

[Decode the error](https://restorecord.tech/verification-callback)

## Questions engineers ask first

### 

### 

### 

### 

### 

## Run the pipeline on your own server

Connect a bot, verify from a spare account and watch every stage on this page happen for real.

[Create an account](https://restorecord.com/register)[Read the docs](https://restorecord.com/docs)