Verification

1. 1

   Member clicks Verify

   The button on the verify message opens https://keepcord.app/verify/<guildId> (or your custom domain).
2. 2

   Captcha and fingerprint

   Cloudflare Turnstile runs invisibly. The page computes a device fingerprint (screen, timezone, languages, canvas hash) used for alt detection.
3. 3

   Discord authorization

   The member is sent to Discord with identify guilds.join plus the optional scopes you enabled. Discord shows exactly what is requested.
4. 4

   Checks

   Keepcord resolves IP intelligence (country, ISP, VPN), computes the trust score, runs blacklist / whitelist, account age, country, alt and custom rules.
5. 5

   Outcome

   Allowed members get the verified role and are added to the server if they are not in it. Flagged ones get the role plus a flag in the dashboard. Quarantined ones get the quarantine role instead. Blocked ones see a message and a report lands in your log channel with Allow / Deny buttons.

browser  → GET  /verify/:guildId                     page with Turnstile widget
browser  → POST /verify/:guildId/start               { turnstileToken, fingerprint }
api      → 302  discord.com/oauth2/authorize         state is stored server-side (10 min)
discord  → GET  /verify/callback?code&state
api      → POST discord.com/api/oauth2/token         access + refresh token (encrypted at rest)
api      → GET  users/@me, users/@me/connections, users/@me/guilds   (as enabled)
api      → rules, lists, trust score, IP intel, alt check
api      → PUT  guilds/:id/members/:userId           join + verified role (bot token of your app)
api      → POST log channel                          verification report (embed + buttons)
browser  → GET  /verify/:guildId/result?status=...

A number from 0 to 100 computed at verification time and stored on the authorization. It is informational by default; use it in a custom rule or as the minTrustScore of a pull to act on it.

Everything below lives under Dashboard → Security.

• Captcha: Cloudflare Turnstile, on by default. Invisible for most humans.
• Minimum account age in days. Younger accounts are blocked with a clear message.
• Blocked countries: ISO codes, matched on the IP country.
• Require verified e-mail (needs the email scope).
• VPN / proxy block (Premium), see below.
• Alt detection with action flag, quarantine or block.
• Auto-kick unverified after N minutes, with a kick notice DM you can edit.
• IP policy: full address (default), salted hash only, or nothing. See Privacy & data.

Up to 30 rules, evaluated in order after the built-in checks. Each rule has a condition, an action and an optional message shown to the member.

{
  "id": "young-no-steam",
  "enabled": true,
  "name": "New accounts without Steam go to quarantine",
  "condition": { "type": "account_age_lt", "days": 30 },
  "action": "quarantine",
  "message": "Your account is too new. A moderator will review it shortly."
}

Actions: allow stops evaluation and lets the member in, flag marks the record, quarantine gives the quarantine role instead of the verified one, block refuses the verification.

The IP is looked up at an intelligence provider (proxycheck.io or ip-api) for country, city, ISP, ASN, hosting and proxy flags. When a VPN is detected Keepcord also tries to name the provider from the ISP and ASN (NordVPN, ExpressVPN, Surfshark, CyberGhost, TunnelBear, ProtonVPN, Mullvad, Private Internet Access, Windscribe, Hide.me and others).

With Block VPN on, the verification is refused and stored with status blocked. The report in the log channel is red, lists IP, ISP, provider, user id and device, and offers two buttons:

• Allow: whitelists the user, activates the authorization and adds the member with the verified role.
• Deny: blacklists the user and their IP hash.

Only moderators with Manage Server or Kick Members, or a Keepcord team seat, can press them.

A member is an alt suspect when another verified account in the same server shares one of these:

• the same device fingerprint,
• the same IP (hash or full, depending on your IP policy),
• the same connected account id, for example one Steam or PayPal account linked to two Discord users (needs the connections scope).

The record gets a flag such as shared_connection:steam or shared_ip, the trust score drops, and the configured action runs. The member drawer links the two accounts.

Every verification, allowed or blocked, posts an embed in the log channel: user and account age, trust score, status, flags, connected accounts, IP and ISP, estimated location with coordinates and a map image, browser, operating system and device.

Switches under Security → Verification data turn the report and the map off, and the IP policy decides whether the address appears at all.

Entries can be a user id, an IP, a fingerprint, an e-mail or a country, with a reason and an optional expiry. Blacklisted users are refused and their authorization revoked; whitelisted users skip every check and can lift a quarantine. From Discord: /blacklist, /unblacklist, /whitelist.

Themes and fields

Under Branding → Verify page designer you set title, description, button label, a note under the button, logo, success redirect and one of four themes: aurora, minimal, neon, glass. Colors can be overridden one by one (accent, page background, card, text) and the background accepts a photo or an animated GIF with darkening and blur sliders. A live preview with desktop and mobile widths shows every change before you save. The page follows the language of the member (EN, IT, DE, ES) or the one you force. Images can be uploaded to the Keepcord CDN so they never expire.

Free shows a small "Protected by Keepcord" footer; Premium and Plus can hide it and serve the page from their own domain, see custom domains.