Proxy

The Discord Proxy enforces a strict Content Security Policy (CSP) — a browser security mechanism that controls which URLs your app can load resources from — on all activities. Understanding these rules is essential for loading external resources.

Content Security Policy

CSP restricts which resources an activity can load. Discord only allows requests to your application's origin and mapped domains. External URLs, inline scripts, and unauthorized domains are blocked.

Proxy Rules

@robojs/patch

@robojs/patch provides automatic URL patching via a Vite plugin. It is pre-installed in all activity templates and requires zero configuration.

import { DiscordProxy } from '@robojs/patch'
import react from '@vitejs/plugin-react-swc'
import { defineConfig } from 'vite'

export default defineConfig({
  plugins: [react(), DiscordProxy.Vite()]
})

import { DiscordProxy } from '@robojs/patch'
import react from '@vitejs/plugin-react-swc'
import { defineConfig } from 'vite'

export default defineConfig({
  plugins: [react(), DiscordProxy.Vite()]
})

URL Mapping

Configure URL mappings in the Discord Developer Portal under your application's URL Mappings section. Each mapping associates a path prefix with an external origin.

Use mapped paths in your code:

fetch('/google-fonts/css2?family=Inter')

fetch('/google-fonts/css2?family=Inter')

URL Patching

patchUrlMappings() from @discord/embedded-app-sdk rewrites URLs in third-party libraries that have hardcoded domains:

import { patchUrlMappings } from '@discord/embedded-app-sdk'

patchUrlMappings([{ prefix: '/google-fonts', target: 'fonts.googleapis.com' }])

import { patchUrlMappings } from '@discord/embedded-app-sdk'

patchUrlMappings([{ prefix: '/google-fonts', target: 'fonts.googleapis.com' }])

Custom Proxy Server

For reaching services that Discord's URL Mappings cannot handle (such as specific ports, unsupported protocols, or dynamic URLs), create a custom proxy endpoint:

import type { RoboRequest } from '@robojs/server'

export default async (req: RoboRequest) => {
  const url = req.query.url as string
  return fetch(url)
}

export default async (req) => {
  const url = req.query.url
  return fetch(url)
}

Network Limitations

Security

The proxy hides user IP addresses. Since the SDK runs in the user's browser, a malicious user could modify the data it reports. Do not trust data from the Embedded App SDK as authoritative. Always validate server-side using the OAuth2 access token from authentication.

Next Steps