Bots and webhooks

Three different things live under one tab, and they answer three different questions. This page says which is which, and what each one can and cannot do.

The short version

You want	Use	Direction
A program that reads a channel and writes back into it	A bot account	both ways
Another service to drop a message into a channel	An incoming webhook	into Frenz
To hear about things happening on Frenz	An outgoing webhook	out of Frenz
Somebody to police your chat	A moderator (a person)	neither

Bot accounts

A bot is a real Frenz account, owned by you, with its own handle and a BOT chip next to its name. Create it in Creator studio, Bots & webhooks. You get a token that starts with frz_, shown once and never again, because only its hash is stored.

A program uses that token as a bearer:

Authorization: Bearer frz_...

What a bot can do

Exactly two things:

GET /channels/:channelId/messages reads a community channel.
POST /channels/:channelId/messages writes into one.

Everything else is refused with 403 Bots can only use channel messages in v1. Not "not implemented yet" in the way that usually means "sort of works": the gate is a whitelist of those two routes, so a leaked token cannot post as you, read a DM, spend anything, or touch a single setting.

The two scopes, messages.read and messages.write, can be handed out separately if the bot only needs one of them.

Letting it into a community

The bot is an account, so it has to be a member. Install it by its handle in Community settings, Bots & webhooks. It then reads and writes only in the channels that account can see, under the same permissions any member has.

Rotating and revoking

New token replaces the old one immediately. Delete removes the bot account. Both take effect on the next request, so a token that has leaked stops working the moment you press the button.

Webhooks

Webhooks carry messages and events. They never carry permissions.

Incoming: something else posts into a channel

A community manager makes an incoming webhook, picks a channel and gets a secret URL. Anything that can make an HTTP request posts to it:

POST <the secret url>
{"content": "the build is green"}

The line lands in that channel with a BOT flag on it. There is no token and no account, which is why it can only ever write into the one channel it was made for.

Outgoing: Frenz tells you something happened

Two flavours, and they are separate on purpose:

Community webhooks (Community settings) send community events: message.created, member.joined, and so on.
Creator webhooks (Creator studio) send your own channel events: going live, a new sub, fuel, a new follower. Useful for a Discord relay, a stream overlay, or your own bot.

Every delivery is signed. X-Frenz-Signature is an HMAC-SHA256 of the raw request body, hex encoded, using the webhook's secret. Verify it before you act on the body, or anybody who learns your URL can tell you whatever they like.

const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
const ok = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));

Compare the raw body, not a re-serialised object. JSON.parse then JSON.stringify gives you different bytes and a signature that never matches.

Can an outside bot moderate my channel?

No, and this is deliberate.

There is no moderation scope, no moderation webhook, and no way to grant one. A bot token is refused on every route except the two message ones, so deleting a line, handing out a timeout and banning somebody are all 403 no matter how the request is made. An incoming webhook can only write a message. An outgoing webhook only tells you something happened, after it happened.

Moderation on Frenz is people:

Community channels are moderated by community roles, set in Community settings.
Your stream chat is moderated by the channel moderators you appoint in Creator studio, Moderators. They can delete lines and hand out timeouts, and nothing else.

An automated bot that watched chat and deleted lines by itself is a reasonable thing to want, and it needs a real permission model first: a moderation scope, an audit trail naming which bot did what, and a way to take it back mid incident. Handing a token that power without those is how one leaked string empties a channel. It is not built, and until it is, the honest answer to "can my Discord mod bot run my Frenz chat" is no.

Automod is separate, and it is already on

Every stored message goes through automod whether a bot wrote it or a person did. That is server side, always on, and not something a bot opts into or out of. It is not a replacement for a moderator, and it does not need one to work.