Skip to content
Docs menu: Recovery key

Protection

Recovery key

In short

A recovery key is a long code only the owner can make. If the owner's Discord account is lost, someone in the server can enter the key on the Bastion website. After a 48 hour wait that the owner or a trusted person can cancel, they become the owner in Bastion.

Why you need one

Some of Bastion's settings belong to the owner alone: who is trusted, your staff tiers and which bots are exempt. If the owner's Discord account is lost or stolen, nobody can change them. The recovery key is the way back in.

Make a key

  1. Open the Recovery key page

    On the dashboard, open Emergency, then Recovery key. Only the server's owner on Discord can make a key, or destroy one.

  2. Sign in again if asked

    A key can only be made within 10 minutes of signing in. This stops someone who finds your browser open from making one.

  3. Press Make a recovery key

    The key appears once. It is six groups of five letters and numbers.

  4. Save it

    Write it down or press Download as a text file. Keep it somewhere that isn't your Discord account.

  5. Tick I've saved it

    Then press Done. The key disappears from the page for good.

CarefulBastion can't show you the key again. It only keeps a scrambled copy that can't be turned back into the key. If you lose it, make a new one. The old one stops working at once.

Use a key

  1. Be in the server

    The person using the key must be a member of the server right now, on the Discord account they sign in with.

  2. Open the recovery page

    Sign in to the Bastion website and go to /recover.

  3. Pick the server and type the key

    Capitals and dashes are added for you.

  4. Wait 48 hours

    Nothing changes yet. Bastion posts in the security log and messages the owner and every trusted person. Each message has a Cancel button.

The 48 hours start once Bastion has told someone, not when the key was typed. That means a message to the owner, a post in the security log, or a post in the server. Until then the dashboard says Waiting to notify the owner, and the wait hasn't started. If Bastion is offline, it hasn't started either.

What a recovery owner can do

  • Everything the owner can do in Bastion's dashboard and commands, including owner-only settings.
  • Nothing in Discord itself. Discord still shows the original owner, and Bastion can't change that.
  • They can't make or destroy a recovery key. Every change they make is recorded, and the real Discord owner can see the list and put the trusted list back with one click.
  • They can't remove themselves from being outranked. The real Discord owner can remove a recovery owner at any time from the Recovery key page, or in Discord with /recovery remove.

If it wasn't you

Press Cancel on the alert, or open the dashboard, where a red banner links to the Recovery key page. The owner and any trusted person can cancel. Cancelling stops that attempt and locks the key for 7 days. The key isn't destroyed, and the dashboard shows who cancelled and when. Only the owner on Discord can destroy the key or make a new one, and should if they don't know who used it.

How the key is protected

  • Wrong keys never lock the right key out. After 5 wrong keys for a server in one day, Bastion tells the owner.
  • One person gets 5 tries an hour, and 3 a day for any one server.
  • Every failure gets the same message, so nobody can tell a wrong key from a server with no key.
  • The key is used up the moment a recovery takes effect.
Who should I give the key to?

Nobody, until you need it. Keep it yourself, somewhere offline. If you want a second person to hold it, pick someone you would trust with the whole server.

The person who used the key left the server.

The recovery is dropped. They have to rejoin and enter the key again.

Can a recovery owner make a new key?

No. Only the server's owner on Discord can make or destroy a key. Otherwise a recovery owner could make themselves a way back in after being removed.

I got my account back. How do I undo it?

Open the Recovery key page as the Discord owner and press Remove the recovery owner, or run /recovery remove in the server. /recovery status shows who the recovery owner is. A recovery owner also sees the server in their server list on the dashboard, tagged Recovery owner.

Last updated