For everyone · 4 min read
Why your bot should not request Administrator
What Administrator actually grants, why it is dangerous, and what to do instead.
Administrator is not just 'all the permissions'. It is a switch that turns every permission check off, including the channel-level restrictions server owners rely on to keep private channels private.
What Administrator really grants
- Every current permission, including Manage Server, Manage Roles, Ban Members and Manage Webhooks.
- Every permission Discord adds in the future, automatically.
- Immunity from channel permission overwrites. A deny on #staff-only does nothing.
The real risk is your token
Bot tokens leak through public repos, compromised hosting and malicious dependencies. With Administrator, a leaked token can wipe every server the bot is in. With scoped permissions, the damage stops at what those permissions allow.
Why developers request it anyway
- To avoid 'Missing Permissions' errors while building. Handle those errors instead (see the guide on missing permissions).
- Because a template or tutorial did. Many copy-pasted invite links use permissions=8.
- To future-proof. New features should come with an explicit, visible permission request.
What to do instead
- List the features your bot has and what each one does in the server.
- Map each feature to the specific permission it needs using the calculator or the bot examples.
- Invite with exactly that value and handle missing permissions gracefully in code.
- Document why each permission is needed so server owners can trust you.
It is good for growth, too
Server owners increasingly check invite permissions before adding a bot, and bot lists review them. A small permission set is a trust signal.