Discord `/ping` bot

A minimal Discord bot on Val Town. Have Claude Code? Tell it \"set up this discord bot\" and let AGENTS.md drive — it handles every step below for you.

\n\n

Manual setup

Create the Discord app. Open Discord Developer Portal → New Application. Name it, accept terms, create.
Set 3 env vars in this val's environment variables:\n
- ${check(appId)} DISCORD_APP_ID — General Information → Application ID
- ${check(publicKey)} DISCORD_PUBLIC_KEY — General Information → Public Key
- ${check(botToken)} DISCORD_BOT_TOKEN — Bot tab → Reset Token (shown once, copy now)
\n
Run setup — registers the /ping command and tells Discord to send interactions here:\n
```
curl -X POST ${setupUrl} \\\\\n  -H \"Authorization: Bot <DISCORD_BOT_TOKEN>\"
```
\n
Invite the bot. ${\n inviteUrl\n ? `Open invite URL →`\n : \"(set DISCORD_APP_ID first)\"\n }
Try it. In any channel of the server you invited it to, type /ping. Bot replies Pong!

\n\n

Prefer to set the endpoint manually?

Skip step 3 and paste this URL into the portal at General Information → Interactions Endpoint URL:

${interactionsUrl}

Then register the slash command yourself by calling Discord's PUT /applications/{id}/commands API.

\n`);\n});\n\n// ─── Discord interactions webhook ────────────────────────────────────────────\n// Discord POSTs every interaction here. PING (type 1) is the endpoint-validation\n// handshake — we MUST reply PONG within a few seconds or Discord rejects the\n// endpoint URL. The ed25519 signature on the raw body proves the request came\n// from Discord (verified with DISCORD_PUBLIC_KEY).\n\napp.post(\"/interactions\", async (c) => {\n const publicKey = Deno.env.get(\"DISCORD_PUBLIC_KEY\");\n if (!publicKey) {\n console.error(\"[Interactions] DISCORD_PUBLIC_KEY not set\");\n return new Response(\"Bot not configured\", { status: 500 });\n }\n\n const signature = c.req.header(\"X-Signature-Ed25519\") ?? \"\";\n const timestamp = c.req.header(\"X-Signature-Timestamp\") ?? \"\";\n const body = await c.req.text();\n\n const valid = await verifyDiscordSignature({\n publicKey,\n signature,\n timestamp,\n body,\n });\n if (!valid) {\n return new Response(\"Invalid request signature\", { status: 401 });\n }\n\n const payload = JSON.parse(body);\n\n if (payload.type === PING) {\n console.log(\"[Interactions] PING → PONG\");\n return c.json({ type: PONG });\n }\n\n if (payload.type === APPLICATION_COMMAND) {\n const name = payload.data?.name;\n console.log(`[Interactions] /${name}`);\n if (name === \"ping\") {\n return c.json({\n type: CHANNEL_MESSAGE_WITH_SOURCE,\n data: { content: \"Pong!\" },\n });\n }\n return c.json({\n type: CHANNEL_MESSAGE_WITH_SOURCE,\n data: { content: `Unknown command: ${name}` },\n });\n }\n\n console.warn(`[Interactions] Unhandled type: ${payload.type}`);\n return c.json({ error: \"Unhandled interaction type\" }, 400);\n});\n\n// ─── Admin: one-shot setup ───────────────────────────────────────────────────\n// Registers slash commands AND sets Discord's interactions endpoint URL to\n// point at this val. Idempotent — safe to re-run. Gated by the bot token so\n// random callers can't make us hit Discord's API on their behalf.\n\napp.post(\"/setup\", async (c) => {\n const expectedToken = Deno.env.get(\"DISCORD_BOT_TOKEN\");\n if (!expectedToken) {\n return c.json({ ok: false, error: \"DISCORD_BOT_TOKEN not set\" }, 500);\n }\n const provided = (c.req.header(\"Authorization\") ?? \"\").replace(/^Bot\\s+/i, \"\");\n if (provided !== expectedToken) {\n return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n }\n\n const appId = Deno.env.get(\"DISCORD_APP_ID\");\n const publicKey = Deno.env.get(\"DISCORD_PUBLIC_KEY\");\n if (!appId) return c.json({ ok: false, error: \"DISCORD_APP_ID not set\" }, 500);\n if (!publicKey) {\n return c.json({\n ok: false,\n error:\n \"DISCORD_PUBLIC_KEY not set — Discord's endpoint validation PING will fail without it\",\n }, 500);\n }\n\n const interactionsUrl = `${new URL(c.req.url).origin}/interactions`;\n\n // 1) Register /ping\n const regRes = await registerCommands({\n appId,\n botToken: expectedToken,\n commands: PING_COMMANDS,\n });\n const regBody = await regRes.text();\n if (!regRes.ok) {\n return c.json({\n ok: false,\n step: \"register-commands\",\n status: regRes.status,\n detail: tryJson(regBody),\n }, 500);\n }\n\n // 2) Tell Discord to POST interactions here. Discord will PING this val\n // synchronously to validate; the call only returns 200 if our /interactions\n // handler correctly verified the signature and replied PONG.\n const epRes = await setInteractionsEndpoint({\n botToken: expectedToken,\n url: interactionsUrl,\n });\n const epBody = await epRes.text();\n if (!epRes.ok) {\n return c.json({\n ok: false,\n step: \"set-endpoint\",\n status: epRes.status,\n detail: tryJson(epBody),\n hint:\n \"If status is 400 with an endpoint validation error, DISCORD_PUBLIC_KEY is probably wrong — re-copy it from Discord's portal.\",\n }, 500);\n }\n\n return c.json({\n ok: true,\n registered: PING_COMMANDS.map((cmd) => cmd.name),\n interactionsUrl,\n inviteUrl: buildInviteUrl(appId),\n });\n});\n\nfunction tryJson(s: string): unknown {\n try {\n return JSON.parse(s);\n } catch {\n return s;\n }\n}\n\nexport default app.fetch;\n","deleted","label",[124],"6152b7ec-5933-11f1-a03c-ee650bb23af1","README.md","019e659d-3aea-7032-8d10-67c92f824033",["D",1779821263544],"# discord-bot\n\nA minimal Discord bot with a `/ping` slash command, deployed on Val Town.\nInteractions arrive over HTTP — no Gateway connection, no `discord.js`, no\nalways-on process.\n\n## Features\n\n- `/ping` slash command — replies \"Pong!\"\n- One-shot `/setup` endpoint registers commands and points Discord at this val\n (uses Discord's `PATCH /applications/@me` API — no manual portal config of\n the interactions URL)\n- Signed-request verification with native Web Crypto Ed25519 (no npm dep)\n- `AGENTS.md` — Claude Code can drive the entire setup end to end\n- Easily extensible: add commands by editing `lib/discord.ts` and the handler\n in `interactions.ts`\n\n## Setup (~2 minutes)\n\nThe fastest path: tell Claude Code _\"set up this discord bot\"_ and let\n[`AGENTS.md`](./AGENTS.md) drive. Manual path:\n\n1. **Remix this val** so you have your own copy.\n2. **Create the Discord app** at\n [Discord Developer Portal](https://discord.com/developers/applications) →\n _New Application_. Pick a name, accept terms, create.\n3. **Paste 3 secrets** into your val's\n [environment variables](https://www.val.town/settings/environment-variables):\n - `DISCORD_APP_ID` — General Information → Application ID\n - `DISCORD_PUBLIC_KEY` — General Information → Public Key\n - `DISCORD_BOT_TOKEN` — Bot tab → _Reset Token_ (shown once)\n4. **Run setup** — registers `/ping` and sets the interactions endpoint:\n ```\n curl -X POST /setup \\\n -H \"Authorization: Bot \"\n ```\n5. **Invite the bot** using the URL returned by step 4 (also shown on the val's\n homepage).\n6. Type `/ping` in any channel where the bot is present → \"Pong!\"\n\nThe val's HTTP homepage (`GET /`) shows live env-var status and copy-pasteable\ncommands — open it after remixing.\n\n## Why this exists\n\nDiscord doesn't have a Slack App Manifest equivalent — there's no URL that\ncreates a pre-configured app from a JSON blob. But Discord's\n[Edit Current Application](https://discord.com/developers/docs/resources/application#edit-current-application)\nAPI lets you set the interactions endpoint programmatically once you have the\nbot token, and slash commands have always been registerable via API. This\ntemplate uses both so the user's only portal work is _create app + copy 3\nvalues_.\n\n## Architecture\n\n```\ndiscord-bot/\n├── interactions.ts # HTTP entry: setup page + Discord webhook + /setup admin\n├── AGENTS.md # Claude Code setup script\n├── README.md\n└── lib/\n ├── verify.ts # Ed25519 signature verification (Web Crypto)\n └── discord.ts # Discord REST helpers + command definitions\n```\n\nDiscord POSTs every interaction to `/interactions`. The handler verifies the\ned25519 signature on `(timestamp + body)` using `DISCORD_PUBLIC_KEY`, then\nreplies inline — slash commands return their response in the same HTTP request\n(no follow-up token needed for fast handlers like `/ping`).\n\n## Customization\n\n- **Add a slash command** → add it to `PING_COMMANDS` in `lib/discord.ts`, add\n a case in the `APPLICATION_COMMAND` handler in `interactions.ts`, then re-run\n `POST /setup` to register it.\n- **Long-running command** (>3s of work) → respond first with\n `DEFERRED_CHANNEL_MESSAGE_WITH_SOURCE` (type 5), then PATCH the original\n message via `/webhooks/{app}/{token}/messages/@original`. Or dispatch to a\n second HTTP route (early-return pattern, see the\n [Slackbot template](https://www.val.town/x/templates/ai-slackbot)).\n- **Change scopes/permissions** in `buildInviteUrl()` in `lib/discord.ts`.\n\n## Version pinning\n\nThis val uses\n[pinned imports](https://docs.val.town/reference/version-control/#imports--pinning)\nto avoid breaking changes:\n\n1. `hono@4.12.0`\n\n(Discord API calls use native `fetch`; signature verification uses native Web\nCrypto. No other dependencies.)\n",[140],"6152944c-5933-11f1-a03c-ee650bb23af1","AGENTS.md","019e659d-3aea-7032-8d10-63535d042588",["D",1779821263544],"# AGENTS.md\n\nYou (Claude Code) are helping the user set up a Discord bot from this template.\nDiscord requires the user to do a few clicks in the developer portal (no\nSlack-manifest-URL equivalent exists), but everything after that — env vars,\nslash command registration, interactions endpoint URL, invite URL — you handle\nvia the Val Town MCP and Discord's REST API. Below is the exact script.\n\n## Tooling assumed\n\nYou have the Val Town MCP available. The relevant tools:\n\n- `list_vals` — find the user's remixed copy of this val\n- `remix_val` — if they haven't remixed yet\n- `list_files` — get the deployed HTTP endpoint URL of the remixed val\n- `add_env_var` — write the three Discord secrets onto the val\n- Bash `curl` — call the val's `/setup` endpoint with the bot token\n\n## What only the user can do\n\nThese steps require a logged-in human in a browser. Don't try to automate them.\n\n- Create the Discord application in the developer portal\n- Accept Discord's developer terms\n- Reset the bot token (shown only once, in the portal)\n- Click the final invite URL to install the bot in a server\n\nEverything else, you do.\n\n## Setup script\n\nWork through these in order. Don't dump them all at once — ask for one\nartifact at a time so the user can paste it back without losing their place.\n\n### 1. Find the remixed val\n\nIf the user already remixed this template, call `list_vals` with `name:\n\"discord-bot\"` filtered to their handle. Otherwise call `remix_val` on\n`dcm31/discord-bot` first, then proceed.\n\nSave the val's `identifier` (e.g. `/discord-bot`) — you'll use it for\nevery other tool call.\n\n### 2. Get the deployed URL\n\nCall `list_files` on the remixed val. Find `interactions.ts` in the result.\nUse the value of `links.endpoint` exactly as returned — do not construct the\nURL yourself; Val Town's deployed URLs are non-obvious.\n\nCall this `VAL_URL` for the rest of this doc.\n\n### 3. Walk the user through Discord portal\n\nSend the user this verbatim:\n\n> Open and click **New\n> Application**. Pick any name (renameable later), accept the terms, click\n> **Create**.\n>\n> On your new app's page, copy three values and paste them back here:\n>\n> 1. **Application ID** (General Information page)\n> 2. **Public Key** (General Information page)\n> 3. **Bot Token** — go to the **Bot** tab, click **Reset Token**, copy what\n> appears. _You only see it once — copy it before navigating away._\n\nWait for all three before continuing. Don't proceed with partial values.\n\n### 4. Set env vars on the val\n\nFor each of the three values, call `add_env_var` on the remixed val:\n\n| Env var name | Value from user |\n| ---------------------- | -------------------------- |\n| `DISCORD_APP_ID` | Application ID |\n| `DISCORD_PUBLIC_KEY` | Public Key |\n| `DISCORD_BOT_TOKEN` | Bot Token |\n\nSet all three before continuing. Val Town env var changes propagate to running\nvals within a second.\n\n### 5. Run setup\n\nMake a single curl call:\n\n```\ncurl -X POST /setup \\\n -H \"Authorization: Bot \"\n```\n\nThis does two things server-side:\n\n1. `PUT /applications/{id}/commands` — registers `/ping`\n2. `PATCH /applications/@me` with `interactions_endpoint_url: /interactions` — Discord then PINGs the val to validate; the val replies PONG (signed); Discord accepts\n\nA successful response looks like:\n\n```json\n{\n \"ok\": true,\n \"registered\": [\"ping\"],\n \"interactionsUrl\": \"https://....web.val.run/interactions\",\n \"inviteUrl\": \"https://discord.com/oauth2/authorize?...\"\n}\n```\n\nIf the response is `{\"ok\": false, ...}`, see _Troubleshooting_ below.\n\n### 6. Give the user the invite URL\n\nSend them the `inviteUrl` from step 5 and tell them: _\"Open this, pick a server\nyou're admin of, and authorize. Then type `/ping` in any channel — bot replies\n**Pong!**\"_\n\nThat's the whole flow.\n\n## Troubleshooting\n\nIf `/setup` returns an error, the response JSON tells you which step failed\n(`step: \"register-commands\"` or `step: \"set-endpoint\"`) and includes Discord's\nown error detail.\n\n| Symptom | Likely cause | Fix |\n| ------------------------------------------------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------ |\n| 401 Unauthorized from `/setup` | `Authorization: Bot ` mismatch | Re-check the bot token the user pasted; re-run `add_env_var` |\n| `step: \"register-commands\"`, Discord 401 | Bot token is wrong or revoked | User clicks _Reset Token_ again, repaste |\n| `step: \"set-endpoint\"`, Discord 400 with endpoint validation | `DISCORD_PUBLIC_KEY` is wrong | User re-copies Public Key from General Information page |\n| User runs `/ping` and Discord says \"did not respond\" | Val errored or returned non-200 | Check val logs in Val Town UI |\n| `/ping` doesn't appear in autocomplete | Commands didn't register, or wrong server | Re-run `/setup`; remind user the bot needs to be invited to _that_ server |\n\n## Don'ts\n\n- Don't try to automate the Discord developer portal — Discord has no manifest\n URL or programmatic app creation. The user must visit the portal.\n- Don't construct the val's HTTP URL by hand. Use `links.endpoint` from\n `list_files`.\n- Don't echo `DISCORD_BOT_TOKEN` back to the user once they've pasted it —\n treat it like a password.\n- Don't add steps the user didn't ask for. After `/ping` works, stop.\n",[146],"61529294-5933-11f1-a03c-ee650bb23af1","lib","019e659d-3aea-7032-8d10-5cc06b30b30c",["D",1779821263544],"directory",[152],"pulls","branches","forks","envVars",{"_164":166,"_167":166},"connections",{"_164":40,"_165":40},"count","unfilledCount",3,"emptyCount",{"_18":151,"_20":152,"_125":153,"_127":-5,"_128":66,"_129":64,"_130":107,"_22":199,"_63":40,"_132":155,"_134":-5,"_136":26,"_137":-5,"_175":200,"_87":201},{"_18":192,"_20":193,"_125":194,"_127":153,"_128":66,"_129":64,"_130":107,"_22":195,"_63":40,"_132":188,"_134":196,"_136":26,"_137":-5,"_175":197,"_87":198},{"_18":184,"_20":185,"_125":186,"_127":153,"_128":66,"_129":64,"_130":107,"_22":187,"_63":40,"_132":188,"_134":189,"_136":26,"_137":-5,"_175":190,"_87":191},{"_18":145,"_20":146,"_125":147,"_127":-5,"_128":66,"_129":64,"_130":107,"_22":181,"_63":40,"_132":98,"_134":149,"_136":26,"_137":-5,"_175":182,"_87":183},{"_18":139,"_20":140,"_125":141,"_127":-5,"_128":66,"_129":64,"_130":107,"_22":178,"_63":40,"_132":98,"_134":143,"_136":26,"_137":-5,"_175":179,"_87":180},{"_18":123,"_20":124,"_125":126,"_127":-5,"_128":66,"_129":64,"_130":107,"_22":174,"_63":40,"_132":133,"_134":135,"_136":26,"_137":-5,"_175":176,"_87":177},["D",1779821263544],"children",[],[124],["D",1779821263544],[],[140],["D",1779821263544],[],[146],"61528718-5933-11f1-a03c-ee650bb23af1","verify.ts","019e659d-3aea-7032-8d10-5bd3012bf828",["D",1779821263544],"script","// Verify Discord's ed25519 signature on incoming interaction webhooks.\n// Discord signs (timestamp + raw body) with the app's private key — we verify\n// with the app's public key (set as DISCORD_PUBLIC_KEY env var). Deno's Web\n// Crypto natively supports Ed25519, so no npm dependency needed.\n// https://discord.com/developers/docs/interactions/receiving-and-responding#security-and-authorization\n\nfunction hexToBytes(hex: string): Uint8Array {\n const bytes = new Uint8Array(hex.length / 2);\n for (let i = 0; i < bytes.length; i++) {\n bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n return bytes;\n}\n\nlet cachedKey: CryptoKey | null = null;\nlet cachedKeyHex: string | null = null;\n\nasync function getKey(publicKeyHex: string): Promise {\n if (cachedKey && cachedKeyHex === publicKeyHex) return cachedKey;\n const key = await crypto.subtle.importKey(\n \"raw\",\n hexToBytes(publicKeyHex),\n \"Ed25519\",\n false,\n [\"verify\"],\n );\n cachedKey = key;\n cachedKeyHex = publicKeyHex;\n return key;\n}\n\nexport async function verifyDiscordSignature(args: {\n publicKey: string;\n signature: string;\n timestamp: string;\n body: string;\n}): Promise {\n const { publicKey, signature, timestamp, body } = args;\n if (!signature || !timestamp) return false;\n try {\n const key = await getKey(publicKey);\n const message = new TextEncoder().encode(timestamp + body);\n return await crypto.subtle.verify(\n \"Ed25519\",\n key,\n hexToBytes(signature),\n message,\n );\n } catch {\n return false;\n }\n}\n",[],[152,185],"615267ce-5933-11f1-a03c-ee650bb23af1","discord.ts","019e659d-3aea-7032-8d10-566d7b865bc4",["D",1779821263544],"// Thin wrappers around the Discord REST API calls we need for setup.\n// Docs: https://discord.com/developers/docs/reference\n\nconst API = \"https://discord.com/api/v10\";\n\nexport const PING_COMMANDS = [\n { name: \"ping\", description: \"Replies with pong\", type: 1 },\n];\n\n// Bulk-overwrite this app's global slash commands. Idempotent — safe to retry.\n// https://discord.com/developers/docs/interactions/application-commands#bulk-overwrite-global-application-commands\nexport async function registerCommands(args: {\n appId: string;\n botToken: string;\n commands: unknown[];\n}): Promise {\n return fetch(`${API}/applications/${args.appId}/commands`, {\n method: \"PUT\",\n headers: {\n \"Authorization\": `Bot ${args.botToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(args.commands),\n });\n}\n\n// Set the URL Discord POSTs interactions to. Discord PINGs the URL during this\n// call to validate the endpoint — the URL must be reachable AND respond to a\n// signed PING with PONG before this call returns success.\n// https://discord.com/developers/docs/resources/application#edit-current-application\nexport async function setInteractionsEndpoint(args: {\n botToken: string;\n url: string;\n}): Promise {\n return fetch(`${API}/applications/@me`, {\n method: \"PATCH\",\n headers: {\n \"Authorization\": `Bot ${args.botToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ interactions_endpoint_url: args.url }),\n });\n}\n\n// `applications.commands` is the minimum needed for slash commands; `bot` makes\n// the bot show as a server member. `permissions=0` requests no extra perms\n// beyond what slash commands grant.\nexport function buildInviteUrl(appId: string): string {\n const params = new URLSearchParams({\n client_id: appId,\n scope: \"applications.commands bot\",\n permissions: \"0\",\n });\n return `https://discord.com/oauth2/authorize?${params.toString()}`;\n}\n",[],[152,193],["D",1779821263544],[169,170],[152],["D",1779821263544],{"_16":17,"_85":81},{"_16":17,"_78":79,"_80":81,"_33":34,"_82":83,"_84":26},{"_63":64,"_20":65,"_18":66,"_67":19,"_68":69,"_70":71,"_72":28,"_73":74,"_75":42,"_76":21,"_77":17},"ctx",{"_56":-5,"_109":239,"_240":241,"_242":243,"_244":26,"_245":26,"_246":26,"_247":107,"_248":-5,"_249":-7,"_250":-7,"_251":40,"_252":26,"_253":26,"_254":-5,"_255":26,"_256":26,"_257":26,"_258":-5},"ENV",{"_210":211,"_212":213,"_214":65,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Discord /ping bot

Manual setup

Discord `/ping` bot