Skip to main content
Everything Seraph knows about you hangs off one Seraph account, and that account is your Discord identity. Nothing else is a login: there is no Seraph password to forget, and no separate account per install. Each thing you sign in becomes a session on that account. The launcher is one, every game you sign in is another, and the website is a third. Sessions are listed, labelled and revocable, so signing out one device never disturbs the rest.

​
Linking the launcher

The launcher signs in through your browser the first time you run it:
1

The launcher opens Discord

It sends you to auth.seraph.si/v4/oauth/authorize, which hands you on to Discord’s own consent screen.
2

You approve

Discord asks whether Seraph may see who you are. Seraph never sees your Discord password and never asks for one.
3

The launcher receives a session

Discord returns you to Seraph, the launcher exchanges the result for a token, and writes it to token.json in your Seraph folder.
Because the token is written to the shared Seraph folder, every client on that machine, Lunar, Badlion or Forge, picks up the same session without signing in again.

​
Linking a game

A game cannot catch a browser redirect the way the launcher can, so it uses a device code instead: it shows you a short code, you approve it wherever it is convenient, and the game waits.
1

Run the command

Seraph prints a short code and a link.
2

Approve the code

Seraph opens auth.seraph.si/device for you, and clicking the code in chat opens it with the code already filled in. Sign in with Discord if you are not already, and confirm the code matches the one on your screen. The code is good for 15 minutes.
3

The game picks it up

The game is polling in the background and says Signed in. Seraph is connected to this game. as soon as you approve. Nothing needs restarting.
A code only ever grants what you approve while looking at it. If a code appears that you did not ask for, or someone asks you to approve one “for support”, do not: approving it links their game to your account. Seraph staff will never ask you to approve a device code.
Until you approve, the code buys nothing, so a code read aloud on a stream is worthless by the time anyone acts on it. Running /seraph login again while one is waiting repeats the same code rather than starting a rival sign-in, and signing a game in that was already signed in retires the session it replaces.

​
Seeing what is linked

lists every device signed in to your account, with the client that signed it in and the label it was given, and marks the one you are playing on. The same list, with more detail, is on your account page.
opens seraph.si/account, where each session shows when it was created, when it was last seen and when it expires.

​
Unlinking

Revoking a session takes effect immediately: the device holding it cannot renew, and its next request fails. Anything signed out has to go through the flow again to come back.
token.json is your session. Seraph will never ask you for it, and no genuine support process involves sending it to anyone. If you have shared it, or run a “Seraph” build from somewhere that was not seraph.si, sign out every device from your account page straight away.

​
Your Hypixel key is linked too

Your Hypixel API key is held on your Seraph account rather than in one install’s config:
saves it to the account, so every install you sign in picks it up automatically. Run it with no key to be walked through getting one. See API keys & login for where the key comes from and what it is used for. Clearing it on your account page removes it everywhere. It is only ever sent to Hypixel and to Seraph’s own proxy, and if you have set your own key or proxy, Seraph’s proxy is not used at all.

​
What each credential is

A Seraph API key is not a way to sign in, and a session token is not an API key. Neither is your Discord account: revoking Seraph’s access from Discord’s own settings stops new sign-ins, but existing sessions are ended from your account page.