Review Discord Authorized Apps after a suspicious bot invitation

Discord apps can be attached to a user's account or installed in a server. Those are different permission paths. A user-installed app appears in User Settings under Authorized Apps and can use only the account access you granted. A server-installed app is managed through the server and may have permissions to create channels, edit roles or otherwise act there. A malicious invitation or confusing authorization screen can cause either kind of exposure, so identify the scope before trying to remove anything.

Before you start​

Use the official Discord desktop or mobile app, not the link in the suspicious invitation. Note the app's exact name, developer and what you clicked. If you administer a server, tell another trusted admin before removing a bot that performs essential functions. Capture the permission screen or app details if an incident may need investigation.

Do it step by step​

1. Open User Settings and Authorized Apps. Inspect apps you recognize and any recent or unfamiliar entry. Read the granted permissions, then compare the app with the service you meant to use; a similar icon or name is not proof of ownership.
2. For an app you do not trust or no longer need, use Discord's revoke or remove control for that authorization. Reopen the list to confirm it is gone. This removes future authorized access through that grant; it cannot necessarily erase data the developer already collected.
3. If the invite added a bot to a server, ask an owner or member with Manage Server permission to inspect Server Settings, Integrations, Bots and Apps, and the member list. A personal Authorized Apps review alone will not remove a server installation.
4. Before removing a server bot, record its role, channel access and recent actions. If suspicious, have an authorized admin remove it and audit role permissions, webhooks and changed channels. Limit replacement apps to only the permissions they need.
5. If you also entered a password on an outside site, change it on Discord's real app, secure the linked email and review MFA. Revoking an app is not a substitute for fixing credential theft or a session compromise.
6. Check connected accounts and integrations that share data separately, then monitor for unexpected messages or server changes. Report abuse through Discord's official flow and notify affected members without forwarding the malicious invitation.

Check the result​

The suspicious account grant no longer appears in Authorized Apps; server administrators have checked any corresponding server installation; and permissions, role changes and account sign-in are understood. Normal features that depended on a removed app are identified before reinstalling anything.

If something goes wrong​

If an app is absent from your Authorized Apps, it may be installed only in a server or you may be signed into the wrong Discord account. If you lack Manage Server permission, contact the owner rather than trying to work around the permission model. If the app returns, look for a second authorization or connected external service.

Know the limit​

Discord says a user-installed app cannot read all server or DM information merely because it was authorized to your account; its actual access follows the consented scopes and interactions. Server-installed apps have different capabilities. Revocation stops a grant but cannot guarantee deletion of data already shared with a third-party developer. Discord app installation and authorization