DASHBOARD USER
Manage Server or Administrator
Discord permissions are retrieved from the authenticated user's current server list. The API checks access again for each setting read or write.
PERMISSION MODEL
Access should be
specific and checked.
The public dashboard separates site login from server authorization. Signing in alone does not grant access to configure every guild.
BOT ACCESS
Bot must be installed
The selected server needs AEP Prime installed and the bot must have the Discord permissions required by the module.
SENSITIVE ACTIONS
Server-side validation
Plan amount, payment status, role hierarchy and allowed setting fields are enforced by the API. Frontend values are not treated as authoritative.
PAYMENTS
Verified activation
Cashfree webhooks must pass signature verification. A redirect or client-side success message cannot activate a subscription by itself.