unexpected 401 on PATCH request of discord api - discord

Question

I'm trying to programmatically add a role to a user to indicate their account as 'linked' or 'verified' in relation to my web app. To do so, I take the following steps:
in the frontend, send the user to the authorization url to authorize discord
when authorized, discord returns to my redirectURI, which calls my /discord/callback route
in this route, I get an access_token for the user from /oauth2/token
with the access_token, I get the discord_user object from /users/#me/guilds/${GUILD_ID}/member
So far, all of those requests are successful, and I get the data I expect. However, when I try to PATCH the user, and add a new role, for some reason I get a 401 unauthorized error, and I'm not entirely sure why. The endpoint I'm using is: https://discord.com/developers/docs/resources/guild#modify-guild-member
Here's my code for clarity:
const GUILD_ID = '<removed>';
const redirectURI = 'http://localhost:8000/auth/discord/callback';
const encodedRedirectURI = encodeURIComponent(redirectURI);
const url = `https://discord.com/api/oauth2/authorize?response_type=code&client_id=${process.env.DISCORD_CLIENT}&scope=identify%20guilds.members.read%20guilds.join&redirect_uri=${redirectURI}&prompt=consent`
router.get('/discord/callback', async (req, res) => {
const { code } = req.query;
try {
const params = new URLSearchParams();
params.append('grant_type', 'authorization_code');
params.append('client_id', process.env.DISCORD_CLIENT);
params.append('client_secret', process.env.DISCORD_SECRET);
params.append('code', code);
params.append('redirect_uri', 'http://localhost:8000/auth/discord/callback');
let access_token;
try {
const tokenRequest = await fetch(`https://discord.com/api/v8/oauth2/token`, {
method: 'POST',
body: params,
headers: {
'Content-type': 'application/x-www-form-urlencoded'
}
}).then(r => r.json());
access_token = tokenRequest.access_token;
} catch {
throw new Error('Failed to get access token.');
}
let discord_user;
try {
discord_user = await fetch(`https://discord.com/api/v8/users/#me/guilds/${GUILD_ID}/member`, {
method: 'GET',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${access_token}`
}
}).then(r => r.json());
} catch {
throw new Error('Failed to get user from guild');
}
const discord_user_id = discord_user.user.id;
try {
await fetch(`https://discord.com/api/v8/guilds/${GUILD_ID}/members/${discord_user_id}`, {
method: 'PATCH',
body: JSON.stringify({
roles: [
'foo',
...discord_user.roles
],
}),
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${access_token}`
}
}).then(r => r.json())
.then((data) => {
console.log(data); // 401 unauthorized
});
} catch {
throw new Error('Failed to add role to user');
}
return res.redirect('/settings?state=success');
} catch {
return res.redirect('/settings?state=failure');
}
});

Answer 1

Figured it out:
The role needs to be the ID of the role, not the name of the role, e.g.: '957197947676803072' instead of 'foo'
The role setting needs to be done by a bot:
await fetch(`https://discord.com/api/v8/guilds/${GUILD_ID}/members/${discord_user_id}`, {
method: 'PATCH',
body: JSON.stringify({
roles: ['957197947676803072', ...discord_user.roles]
}),
headers: {
'Content-Type': 'application/json',
'Authorization': `Bot ${process.env.DISCORD_BOT_TOKEN}`
}
}).then(r => r.json())
I also needed to give that bot account admin permissions and manage roles permissions. You can do this either in the invite link or in your discord's server settings.