Secure Authentication#

We prioritize absolute security. The Charged API strictly uses an automated, session-based authentication architecture. We have completely deprecated manual JWT handling and localStorage storage.

Upon authenticating via Discord OAuth2, our backend Fastify server generates an encrypted session token and sets it as an HTTP-Only, Secure cookie. This means the token is entirely invisible to JavaScript running in your browser, making Cross-Site Scripting (XSS) token theft impossible.

When you make a request to the API, your browser automatically attaches this cookie. The server decodes it, verifies your Discord identity, and ensures you have the necessary permissions before fulfilling the request.