Discord Embedded App SDK: How Activity Proxies Obscure Developer Server IPs

The Evolution of Discord In-App Activities

Discord shifted from basic text bots to rich multiplayer games and collaborative tools (Poker Night, YouTube Watch Together, Gartic Phone) rendered directly inside voice channels using the Discord Embedded App SDK. To protect developer backends from direct targeting, Discord engineered a specialized Activity Proxy Architecture.

How the Discord Activity Proxy Protects Origin Servers

When users launch an activity inside a Discord client iframe:

• Reverse Proxy Rewriting: The iframe client communicates with https://<app_id>.discordsays.com rather than the developer raw origin server IP.
• Stripping Client IP Headers: Discord edge proxies strip user residential IP addresses from HTTP request headers, replacing them with Discord datacenter Anycast IPs to preserve end-user privacy.
• Content Security Policy (CSP) Sandboxing: The activity iframe enforces strict CSP rules, preventing unauthorized cross-origin data exfiltration and unauthorized WebSocket connections.

Best Practices for Activity Developers

1. Validate the X-Signature-Ed25519 header on all incoming webhook and OAuth2 state payloads.
2. Always map Discord user IDs to backend session states rather than relying on client IP fingerprints.

Explore our report on Discord webhook rate limiting and Cloudflare security.

Check if your outward IP is exposed to public scanners on our free online IP check suite.