Build integrations with limited access
Your service runs outside Dilack. After review, an admin installs the plugin on one server and grants each permission. Never put the API key in a browser.
From draft to installation
- Sign in, create a developer account, then add an English and Portuguese name, summary and description.
- Choose a category and the minimum scopes. Upload a JPEG, PNG or WebP logo up to 256 KB and banner up to 1 MB.
- Store the key shown once. Submit for review. Changes to scopes or listing require a new review.
- An admin installs per server, confirms scopes and chooses the channel where messages may appear.
Available scopes
server.infoInstalled server name and ID.channels.listList of public text channels in that server.text.postPost text only to the channel chosen by an admin.No scope reads messages, private profiles, cookies or another server’s data.
Server-to-server requests
Use HTTPS and send the key as a Bearer token. The server ID is shown in the plugin installation.
Authorization: Bearer dlk_... GET https://dilack.com/api/plugins/bridge?server=<server-id>&resource=server GET https://dilack.com/api/plugins/bridge?server=<server-id>&resource=channels
To post a message in the configured channel:
POST https://dilack.com/api/plugins/bridge
Authorization: Bearer dlk_...
Content-Type: application/json
{"server":"<server-id>","action":"post_text","body":"Hello from my plugin"}The body accepts up to 4,000 characters. The response includes message and channel IDs. The limit is 60 calls per minute per plugin.
401Invalid key or plugin not installed in this server.403Scope not granted.429Rate limit exceeded.Security rules
- Run your plugin on your backend. Dilack never loads third-party JavaScript.
- Never expose the key in a frontend, repository or logs. Rotate it in the portal if it may have leaked.
- Installation and channel selection are per server. Uninstalling immediately revokes access.
- Public listing requires review. Uploaded artwork accepts size-limited raster formats only.