Documentation Index
Fetch the complete documentation index at: https://mintlify.com/discordplace/discord.place/llms.txt
Use this file to discover all available pages before exploring further.
Protected endpoints on the discord.place API use API key authentication. You pass the key in an Authorization request header — no bearer prefix, token scheme, or encoding required.
Generating an API Key
Open your bot's manage page
Navigate to your bot’s listing and click the Manage button.
Go to the API Keys tab
Inside the manage page, select the API Keys tab from the navigation.
Generate a new key
Click Generate API Key. Copy the key immediately — it will not be shown again. You can rotate the key at any time from the same tab.
Treat your API key like a password. Never expose it in client-side code, public repositories, or anywhere an untrusted party could read it. If a key is compromised, rotate it immediately from your bot’s manage page.
Using the API Key
Include the key as the value of the Authorization header on every authenticated request:
curl -X PATCH https://api.discord.place/bots/123456789012345678/stats \
-H "Authorization: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"server_count": 1500}'
In Node.js, load the key from an environment variable:
const response = await fetch('https://api.discord.place/bots/123456789012345678/stats', {
method: 'PATCH',
headers: {
'Authorization': process.env.DISCORD_PLACE_API_KEY,
'Content-Type': 'application/json'
},
body: JSON.stringify({ server_count: client.guilds.cache.size })
});
Error Responses
If the Authorization header is missing or the key is invalid, the API returns a 401 response.
{
"success": false,
"error": "Authorization header is required.",
"status": 401
}
{
"success": false,
"error": "Invalid API key.",
"status": 401
}
Security Best Practices
- Store API keys in environment variables or a secrets manager — never hard-code them.
- Restrict access to the key to only the services that need it.
- Rotate the key if there is any chance it was exposed.
- Do not log the raw value of the
Authorization header in production.