Xenon vs VaultCord: the alternative with no OAuth gate

VaultCord and Xenon both back up Discord servers, but they work differently. VaultCord can re-add members after a server is lost, by asking every member to authorize an application when they join. Xenon can’t re-add members, but it keeps more restore points, has a template gallery and cross-server sync, and needs nothing from your members or your Discord account.

The short version

	VaultCord	Xenon
Re-adds members after a server is lost	Yes, if they verified beforehand, capped once Discord limits the owner	No
Restore points, free then paid	Not published	15, then 50, 100, 250
Messages saved per channel	Not published per plan, 350 advertised on free	0, 50, 100, 250
Price per month	$0, $4.97, $9.97	$0, $5.99, $10.99, $15.99
Asks your members to authorize anything	Yes	No
Discord application registered to you	Yes, on every plan	No
Logs member IPs, emails, and friend lists	Yes	No
Templates and cross-server sync	No	Yes
VPN and alt-account filtering	Yes	No

Choose VaultCord if getting members back after losing a server is the main requirement, and set it up before you need it. Choose Xenon if you want to undo damage to the server itself, such as a raid, a compromised admin, or a bad permission change.

How member recovery works

VaultCord can re-add members. Xenon can’t, and no bot can do it through Discord’s bot API, because there’s no endpoint that moves an account from one server to another. If you lose a server, Xenon rebuilds the channels, roles, permissions, and settings on a new one, and you send members an invite.

VaultCord calls its approach “OAuth2 member verification”. It uses guilds.join, a documented OAuth2 scope. When members join your server, a verification page asks them to let an application add them to servers, and VaultCord stores that permission. If the server is lost, it uses the stored permissions to add those members somewhere new. Discord allows this. The only stated condition is that the bot is already in the server it adds people to.

There are four limits, and they apply to every service built this way:

• It only covers members who verified after you set it up. Turning it on after a raid recovers nobody.
• The permission stays with a third party until each member revokes it, which few people do.
• Discord won’t add a user who is banned from the target server, so members a hostile admin banned on the way out don’t come back.
• Since June 2026 there’s a daily cap. Once Discord restricts the account that owns the bot or the server, pulls drop to somewhere between a few dozen and a few hundred members a day. Discord hasn’t documented this. RestoreCord’s support staff described it in their public Telegram group and said it “happens to every single bot”, which includes VaultCord’s. Our RestoreCord comparison has the messages.

What the verification page collects

The verification page also collects data about your members, and VaultCord’s pricing table lists what server owners get to see:

Three rows from VaultCord’s pricing table, with its plan header, 22 October 2026. Archived copy.

On Premium and Plus, a server owner can see the IP address of anyone who verified, along with their Discord email, connected accounts, and server list. On every plan, including Free, “Discord Friends List Logging” will “capture and store member friend-list data to configured logging destinations.”

The IP address comes from visiting the verification page. The rest comes from what the member authorizes there. A friends list can only be read through one OAuth2 scope, relationships.read, which Discord describes as access to “a user’s Discord Friends list, their pending requests, and blocked users.” Discord lists it under its Social SDK, which is meant for games that show your Discord friends in-game.

This data goes to the server owner, not only to VaultCord. Verifying once in a server lets its owner see your email address, and your friends list goes wherever that owner sends the logs. A friends list is also mostly about other people, and none of them visited the page or agreed to anything.

Xenon has no verification page and collects nothing from your members.

The bot is a Discord application you own

Xenon is one Discord application. You add it like any other bot.

VaultCord’s custom bots work differently. You create an application in Discord’s Developer Portal, add a bot to it, and give VaultCord its credentials. That has consequences:

• The application is registered to your account, so Discord’s developer terms apply to you, and enforcement against the bot lands on you.
• The credentials are the bot itself, and they now live on VaultCord’s servers as well as yours.
• VaultCord’s setup instructions don’t mention privileged intents. Without them, backups run and report success but save no message content.

The credentials, and why the intents matter

VaultCord’s API documentation shows which credentials it takes: the endpoint that creates a custom bot accepts a name, an OAuth2 clientSecret, and a Discord token. Its security guidance also tells you to add the bot to a Developer Portal team, which is only possible for an application you own.

The guide does get one thing right. The bot doesn’t need Administrator, and Manage Roles and Create Invites are the only permissions it asks for.

A token and a client secret aren’t a dashboard login. Whoever holds them can act as the bot with every permission you granted, and if they leak, rotating them is your job.

Reading message content or member data requires privileged intents, which you turn on for your application in the Developer Portal. VaultCord’s FAQ covers the redirect URL, the token, and two Discord permissions, which are a different system. It doesn’t mention intents. Nothing warns you if they’re off, because the restriction applies to the REST API a backup reads from and not only to the live gateway. You find out when you restore.

Once a bot can reach 10,000 users, you can no longer turn these intents on yourself. Since June 2026 you have to apply, and Discord can refuse. Xenon’s intents were approved once, on our application.

The comparison page covers this with both alternatives side by side.

VaultCord’s security guide is a ban-evasion guide

VaultCord’s help center has a six-step guide to securing your bot, which sums up the stakes as “bot gone = members gone.” Two steps are ordinary. Two others aren’t:

• Step five tells you to build the bot on an alt account and explains how to keep that account from being linked to your main one: a different device, a VPN, and an antidetect browser. Discord’s Community Guidelines prohibit using new or existing accounts to get around a Discord-level ban.
• Step six tells you to leave phrases like “verify in case of termination” out of your verification message, to “avoid raising red flags.”

You carry out both steps, on an application registered to your account.

The guide's wording

Step five: “If your main account gets terminated and you log into your alt account, Discord may flag it for ban evasion.” The guide then recommends a different device, a VPN, and an antidetect browser, linking the last two by name. Community Guideline 19 prohibits evading permanent Discord-level enforcement by creating new accounts or using existing ones after removal.

Step six asks you to keep phrases like “verify in case of termination” and “verify so we can pull you if our server gets deleted” out of your verification message, and to “use clear and neutral language to avoid raising red flags.”

The two ordinary steps: don’t grant Administrator, and add the bot to a Developer Portal team so losing your account doesn’t lock you out of the application.

Is pulling members against Discord’s rules?

No. guilds.join is documented and allowed.

What matters is disclosure. Discord’s Developer Policy says an app that adds someone to a server must clearly tell them and get explicit permission, with an accurate description of what they’re agreeing to. The two phrases step six tells you to delete are accurate descriptions of what the feature does. A verification message that keeps them is compliant. Following the guide makes it less so, and the guide says the reason is to avoid red flags.

The Developer Policy text

Rule one: “Do not modify a Discord user’s account without explicit permission from the Discord user. Functionality that intends to make any changes to a Discord account (e.g., adding the account to a server) must clearly and properly inform the Discord account owner of the changes and receive explicit permission to enact the changes.”

Rule two: the permission prompt must be “clearly labeled and apparent, and contain an accurate description of the purpose or feature being enabled.”

VaultCord sells members

VaultCord runs a marketplace at vaultcord.com/market, headed “Buy Discord members” and linked from every page of its help center. Sellers list members by the hundred, for $0.08 to $20, sorted by the kind of server they came from. What’s being sold is the stored permission to add someone to a server.

Discord’s Developer Policy prohibits “enabling, or promoting the inflation of server membership with bot or user accounts.” RestoreCord’s own security guide forbids selling members for that reason.

The listings, the rules, and the token joiner

Listing categories include gaming, crypto, Roblox, FiveM, and game cheats. Nothing suggests a server’s members are sold without its owner’s involvement. Sellers list their own inventory.

Developer Policy rule 13 in full: “Do not misrepresent or fraudulently manipulate engagement. This includes participating in, enabling, or promoting the inflation of server membership with bot or user accounts.” Community Guideline 15 says the same to users: “Do not engage with our service in an inauthentic way. This includes artificially inflating server membership, manipulating engagement metrics, and selling artificial engagement services.” Guideline 16 prohibits buying or selling Discord assets.

VaultCord’s GitHub organization also hosts a public repository called Discord-Token-Joiner, described as “Join tokens to a Discord Server using VaultCord OAuth2 (no CAPTCHA!)”, last updated on 1 August 2026. A token joiner drives user-account tokens rather than a bot. Discord calls that self-botting, forbids it, and can terminate the accounts involved. Developer Policy rule three: “Do not enable your Application to bypass or circumvent Discord’s privacy, safety, and/or security features.” We have no evidence VaultCord uses the tool in its own service.

VaultCord and RestoreCord share a founder

VaultCord’s owner built RestoreCord in 2020, sold it in 2022, and then started VaultCord, which is why the two work the same way. They’re separate companies now. RestoreCord is owned by Axvant UG and publishes its own comparison against VaultCord.

Where that comes from

VaultCord’s documentation says its owner “formerly operated KeyAuth, a developer platform with over 190,000 users”. KeyAuth’s changelog from July 2023 says the same founder built RestoreCord in 2020, sold it in 2022, and was starting a new Discord recovery bot. The entry a month later names vaultcord.com.

Where Xenon is better

Most server damage is smaller than a deleted server. It’s usually a deleted category, a permission change that locks people out, or a bot that ran the wrong command. Member recovery doesn’t help with any of that. Having several backups to choose from does.

• More restore points. Xenon keeps 15 backups on the free plan and up to 250 on Premium, each with every channel, role, role position, permission overwrite, and setting. VaultCord doesn’t publish how many backups it keeps, and automatic backups are on its top plan only.
• Nothing asked of your members. There’s no verification page and no permission for anyone to revoke later. Xenon doesn’t log their IPs, emails, or friends.
• No Discord application in your name. There’s no token or client secret to hand over and no privileged intents to remember. Discord’s developer terms bind us, not you.
• No stored member permissions. There’s no list of people who can be added to servers, so there’s nothing of that kind to leak or sell.
• Nothing to hide from Discord. The setup doesn’t involve alt accounts, VPNs, or rewording your verification message.
• Templates, sync, and chatlogs. Xenon has a template gallery published since 2018, with every submission reviewed. It syncs messages, bans, and role assignments across servers, and chatlogs keep up to 1,000 messages from a single channel.

Where VaultCord is ahead

• Member recovery, with the limits described above.
• Lower prices. $4.97 and $9.97 a month against Xenon’s $5.99 and $10.99.
• Messages on the free plan. VaultCord has advertised 350 messages per channel on its free plan. Xenon’s free plan saves none, and its paid plans save up to 250.
• Admission control. VPN and proxy blocking, alt-account detection, and captchas. Xenon recovers servers but doesn’t try to stop raids.

Which to pick

If you need members back after losing a server, VaultCord can do it and Xenon can’t. Set it up early, expect the limits, and know what the verification page collects from your members and which Discord application you’re signing up to own.

For everything else that goes wrong with a server, Xenon gives you more restore points without asking anything of your members.

See the full comparison, or add Xenon and see what a backup holds.

Sources

VaultCord’s plans, limits, and prices come from its own pages, read on 29 August 2026 and again on 22 October 2026. These change, so check the live pages before deciding.

All sources, with the dates we read them

• VaultCord’s pricing table for plans, prices, and the logging features, read and archived on 22 October 2026, and its comparison page for what it says member recovery does
• VaultCord’s bot security guide for the six steps and every phrase quoted from them, and its market for the listings and prices, read on 11 September 2026
• VaultCord’s API guide for the custom-bot endpoint, and its help center for the setup steps, the missing intents, and its owner having run KeyAuth
• VaultCord’s GitHub organization for the token joiner, read on 30 August 2026
• RestoreCord’s public support group on Telegram for the pull limit, with each message linked from our RestoreCord comparison
• RestoreCord’s bot security guide for its rule against selling members, read on 11 September 2026
• Discord’s Developer Policy (effective 8 July 2024) for rules 1, 2, 3, and 13, and its Community Guidelines for guidelines 15, 16, and 19, read on 11 September 2026
• Discord’s OAuth2 documentation for guilds.join and relationships.read, read on 22 October 2026
• The KeyAuth changelog entries of 17 July and 26 August 2023, for the RestoreCord founding and sale
• Xenon’s figures come from our plans page, which shows the live configuration