Discord Is Not Broken, You Gave an App Permission to Join Servers for You

If you keep getting added back to Discord servers you already left, an application on your account is doing it, and leaving again will never stop it. Discord allows apps to hold a standing permission that appears as “Join servers for you”. While that permission sits on your account, whoever runs the app can drop you into any server they like, as often as they like, with no notification to you. Open Settings, go to Authorized Apps, and revoke it. Then change your password and log out every device, in that order. The order is what makes the fix stick.

Open Authorized Apps and read the permission line under each entry

Use the desktop app or the browser version, because the list is easier to read there. Click the gear icon beside your username to open User Settings, then find Authorized Apps in the left sidebar. You will see every application you have ever approved, and under each one, the specific permissions you handed over.

Read those permission lines rather than the app names. Names are chosen to look harmless. The line you are hunting for says the app can join servers for you, and the moment you find it, click Deauthorize. If you see apps you have no memory of approving at all, remove those too. Nothing on that page is load bearing for normal Discord use, so you can be aggressive with one exception, which I will get to below.

Four different things produce exactly this symptom

They look identical from your side. The fix is different for each, so work out which one you are in before you start.

A grant from a scam DM	A message offering free Nitro, a game beta, an art commission or a giveaway sent you to a real Discord authorisation screen. You clicked Authorize without reading. The app now rejoins you to servers it is paid to inflate.
A server that demanded the grant to let you in	Some giveaway and boost farming servers put an authorisation step in place of a normal verification bot. Passing it hands over the same permission. This is the one people forget, because at the time it felt like a captcha.
A creator integration you actually pay for	Patreon and Ko-fi use the same permission to put paying members into a creator’s server automatically. If you are being added to a server run by someone you support, this is almost certainly why, and revoking it will break your access.
A compromised account	Malware or a phishing page took your session token. The attacker does not need any permission at all, because they are operating as you. Revoking apps will not touch this.

How to tell an app grant apart from a hacked account

Here is the test nobody writes down, and it takes about a minute.

An app permission can do exactly one thing to you. It can put you in servers. It cannot read your direct messages, cannot send anything as you, cannot change your email and cannot add friends. So if the only strange thing happening on your account is server joins, and Authorized Apps shows something holding that permission, you have found your answer and you can stop worrying.

Now look for the other pattern. Go to User Settings and open Devices. That page lists every active session with the device type, a rough location and when it was last used. A session you do not recognise is the single clearest sign that somebody is inside the account itself. Other signs stack alongside it. Friends receiving links from you that you never sent. Messages disappearing from your outbox. Email from Discord about a login or a password change you did not start. Servers you own suddenly missing a role or an emoji.

If Authorized Apps is completely clean and the joins keep happening anyway, treat it as a compromise. That combination has no other sensible explanation.

Do these steps in this order or the joins come back

This part is worth slowing down for, because doing it out of order is the reason people report the problem returning a week later.

1. Deauthorize every app holding the join permission, plus anything you do not recognise.
2. Change your Discord password. This matters more than it looks. A stolen session token keeps working even after you revoke apps, and a password change is what forces Discord to issue a fresh one and retire the old.
3. Open Settings, go to Devices, and use Log Out All Known Devices at the bottom. You will need your password and, if you have it on, your two factor code. Your current session stays signed in.
4. Turn on two factor authentication if it is off. An authenticator app is stronger than SMS.
5. Only now, leave the servers again.
6. Check your email account as well. If the attacker got into Discord through your inbox, they may have added a forwarding rule that survives everything you just did.

If any of this pointed at malware rather than a careless click, take the machine seriously. Token stealers arrive inside things people download on purpose, such as a cracked game, a modified Discord client, a cheat tool or a file a stranger sent for you to test. Run a full scan, and change the passwords for anything you signed into from that computer. Discord is recoverable in an afternoon. A banking login or a password manager that was open on the same machine is a much longer week, and that is the reason to treat a stolen token as more than a nuisance.

Blocking the server owner will not help you

Search this problem and the top advice is always the same. Leave the server, block whoever runs it, report the invite, move on with your life. It sounds decisive and you were expecting me to agree with it.

It does nothing. The server owner is not sending you an invite, so there is no invite to report and no sender to block. The app is calling Discord’s own interface and telling it to add a member, using a permission you granted, and that call succeeds whether you have blocked anybody or not. You can block every account in that server and be back inside it within the hour. The permission is the only thing that matters, and until it is gone, nothing else you do registers.

Yes, the permission has legitimate uses

Before you clear the whole list, check for the ones you want. If you support somebody on Patreon or Ko-fi and get access to their members server as part of it, that access runs on this exact permission. Pull the grant and you lose the server you are paying for, then spend an evening working out why.

Patreon lets you manage this per creator rather than all at once. Sign in to Patreon, open your settings, find the connected apps section, and disconnect only the creators whose servers you no longer want. Ko-fi works in a similar way through the creator’s own setup. Sort those out first, then go back to Discord and remove everything that is left over.

How to avoid handing it out again

Discord’s authorisation screen is honest about what it is asking for. Almost nobody reads it, because it appears at the exact moment you are trying to get somewhere and it looks like a formality. Slow down when it appears. The permissions are listed in plain English in the middle of the box, and if one of them mentions joining servers on your behalf, ask yourself why a giveaway bot would need that.

Two harder rules are worth keeping. Discord will never ask you to paste code into a browser console, and any site or friend telling you to do so is trying to take your token. Free Nitro from a stranger has never once been real. Both of those lead to the fourth row of the table above, and that row is the only one on this page that can cost you more than an annoying server.

Once the permission is gone and the sessions are cleared, the joins stop the same day. If they carry on after all six steps, the account is still reachable by somebody, and that is the point to contact Discord support rather than repeat the cycle.