Three ways in without verifying
Auto-verification does not let someone past the check. It marks them as verified, which is a different thing: they get the verified role, they lose the unverified one, and the success is written to your log like any other. Run /verifyinfo on them later and it names which of the three doors they came through.
They are checked in a fixed order as the member walks in, and it is the order the three cards sit in under Auto-verification in your dashboard:
- The whitelist is a short list of people you name yourself. It is the first check.
- Returning members covers people who were already verified here, left, and came back.
- Invite links Premium covers anyone who joins through a link you marked as trusted.
The three are independent. You can turn on any of them without the others, and a member only ever passes through one, whichever comes first.
Members who come back
Discord does not give a member their roles back when they rejoin, so someone who was verified here last week would be back at the verification channel like a stranger. Turn this on and their role is restored as they walk in.
Returning members
Between 1 hour and 365 days. Leave the field empty and there is no limit: anyone who was verified here gets their role back, however long ago it was.
If it does not apply, because the switch is off or they were away too long, nothing bad happens to them. They are simply treated as a new member and verify again from scratch, with their attempt count reset to zero.
A member who left while the bot was offline
The whitelist
The whitelist is up to ten people who are verified the moment they arrive, ahead of every other check. It is the only thing Easy Auth still trusts during a raid, and it also skips the Join Gate.
Whitelist
People are added by user ID, not picked from a list of members, and that is the point: it lets you clear someone who has not joined yet. Names appear once you save.
The ID is checked when you save. If it does not belong to a real Discord account, or belongs to a bot, or belongs to somebody your staff has blocked, the entry is refused and the reason appears under the field. That last case is the rule worth remembering: a block always wins. /unblock them first if you really mean to trust them.
You can do the same from Discord with /whitelist add, /whitelist remove and /whitelist list, which need the Manage Roles permission. They accept a mention or a raw ID, so they work for somebody who is not in the server either.
Whitelisting somebody who is already in the server does nothing on its own, because the list is read as members arrive. Run /reconcile and they are verified on the spot, along with anyone else the bot missed. That command never punishes anyone, so it is safe to run whenever.
Invite links you trust
Every invite link to your server can be marked as trusted, one at a time. Anyone who joins through a trusted one is verified as they arrive. The usual reason is a link you handed to a partner server or posted somewhere you control, where you already know who is coming.
Invite links
The card has one switch for the whole feature and then one per link, so turning it on does not suddenly trust every invite your server has. You can pick links with the feature still off: the choices are saved and start working when you turn it on.
Easy Auth works out which invite was used by comparing each link's use count before and after the member arrives. Two things follow from that, and neither is a setting you can change:
- It needs the Manage Server permission to read your invites at all. Without it the list cannot even be loaded, and the card says so instead of showing an empty list.
- Vanity URLs are not covered. Discord does not report a use count for them, so a member arriving through one cannot be attributed to it, and they verify normally.
A link is a secret that travels
What overrides all three
Auto-verification is trust you granted in advance, so a few situations take it back.
- A blocked member is never auto-verified, by any of the three. A block is a decision your staff made about one person, and it outranks a rule made in advance.
- During a raid, only the whitelist still counts. Returning members and trusted invites are both ignored while a wave is running, because a link can leak and an old account can be compromised. See the raid mode guide.
- With verification turned off, none of the three does anything. That switch takes the check off your server altogether, so there is no verified state left to grant and nobody is marked as verified.
Closed hours are not the same as turned off
Your log channel always says which door was used. The Verification success entry reads Auto (whitelist), Auto (rejoin) or Auto (invite) under Method, so a member who got in without answering anything is never a mystery afterwards.
One last thing about /reconcile. It replays the whitelist and returning members for people already in your server, but it cannot replay invites: the link somebody used is only knowable in the instant they join, and afterwards that information is gone. If your Premium ends, trusted invites stop being applied while the whitelist and returning members carry on as before.