Roadmap

The developer platform is built in phases. This page says what is done, what is next, and what is planned after, so you can decide what to build on now. Dates are not promised; the order is.

Phase 1: the foundation (done)

• Applications: draft and published, branding, translations, testers, audit log, delete.
• Secrets: client secrets and bot tokens, shown once, kept as hashes, rotatable.
• Domain verification: a TXT record, checked now and every few hours.
• Bots: a bot is a member with a BOT tag; added to a server with the bot scope, a managed role, and exactly the permissions the person chose and could give.
• OAuth2: authorization code with PKCE, refresh tokens (used once), revoke, and Settings > Connected apps for members. Scopes identify, email, servers, bot.
• App API v1: users/@me, users/@me/servers, applications/@me.
• Review and suspension of applications by staff, with the reason shown to the developer; a BOT tag on every bot.
• Developer Portal at developer.moymo.net, this wiki, and Developer mode in the Servers add-on.

Phase 2: bots that do things (done)

• Server reads and changes: servers, channels, roles, members, invites; nicknames, roles, timeout, kick and ban, with the same ladder as people.
• Messages: read (paged), send, edit, delete, replies, pins, reactions, typing, allowed_mentions, a nonce for safe retries, a Moymo game card.
• Embeds and components (buttons and select menus of every kind), with Discord's shapes and limits.
• Intents (SERVER_MEMBERS, PRESENCE, MESSAGE_CONTENT) guarding what a bot may see of other people.
• Slash commands and context-menu commands with sub-commands, options of every type but attachments, choices, autocomplete, localised names, default permissions and bulk overwrite.
• Interactions answered over a signed HTTPS endpoint (Ed25519, verified with a ping and a forged ping), with 3-second answers, ephemeral and deferred responses, followups for 15 minutes, modals (rows and labels).
• Rate limits in Discord's scheme: buckets, X-RateLimit-* headers, Retry-After.
• The portal's Interactions and Commands tabs, and intents on the Bot tab.

Still to come in this phase

• Bulk delete, listing a message's reactions, removing other people's reactions.
• Files and pictures on messages a bot sends.
• Attachment options on commands, layout components (containers, sections, galleries), file uploads in modals.
• Per-server overrides of who may use a command, and command localisation in the picker.
• An OpenAPI description of everything, published with the wiki.

Phase 3: events and more (after)

• The gateway (WebSocket): events, intents, resume. Fed by the same stream that drives Moymo for Windows, so a bot sees what a member sees. Interactions can then also be received over it, without an endpoint.
• Webhooks: incoming (post to a channel without a bot) and outgoing event webhooks.
• Public data API keys: read the public game catalogue, public profiles and leaderboards with a key.
• Teams: several people owning one application, with roles (admin, developer, read-only).
• The App Directory: find published applications.
• More scopes: library.read, playtime.read, profile.read, friends.read, activity.write, servers.join, role connections.
• Rooms: forum posts, to-do lists, documents, polls, giveaways, calendar events, party boards, voice state reads.

Phase 4: libraries

• moymo.js, the first SDK, then others, generated from the descriptions above.
• A command-line tool for the portal's calls.

Things we will not do

• Let a bot read sealed text. Where a channel's text is end-to-end sealed, a bot gets the event without the content.
• Let an application act as a member beyond what they allowed. A token is a scope, never a password.
• Sign a bot in as a person. A bot is not an account anyone can sign in to.

Tell us what is missing

The plan is shaped by what people need. Use Suggest a change on any page, or write on Moymo. Say what you are building and what stopped you.