Deleting your own Discord history is a rate limiting problem, not a delete problem

#webdev #javascript #discord #opensource

Discord lets you delete a message. One message. Hover over it and pick delete from the menu. Now do that four thousand times. Enjoy your afternoon.

I built a browser extension to do it properly, and the interesting part was not the deleting. Deleting is a single HTTP call. The interesting part is everything around it, because three constraints show up immediately and each one bends the design.

There is no API for this

Start here, because it shapes the rest. Discord has no OAuth scope letting an application read or delete your own message history. Bot tokens do not help either. A bot can manage messages in a server that invited it. Different problem, different permissions. It certainly cannot go and read your DMs from 2019.

So anything in this category works from the session your browser already holds. Worth being blunt about rather than glossing over, because a user should understand it before installing anything. In Clearline the session is read from an open Discord tab, and only when you click Connect. It then stays in that tab's memory. It is never written to storage. Ever. And discord.com is the only host the extension can reach at all, which is enforced at build time rather than by policy.

If you are evaluating any tool that does this, those are the two questions: where does the token live, and what else can this thing talk to?

Authorship has to be checked on every single message

The naive version is simple enough: search for messages by me, then delete them all.

The problem is that search returns things attributed to you that nobody can delete. Join notices and similar system messages carry your name. They come back in results. They also refuse every delete you send at them. Nobody is allowed to remove them.

Count those in the total and you have promised someone 4,000 deletions. The run then finishes with a stack of failures and a headline number that never made any sense in the first place. Bad experience. Worse still, it teaches people to ignore the failure report, which is the one thing you want read.

So the count has to exclude them up front. Clearline names them separately and leaves them alone rather than promising more than it can deliver. The report afterwards also separates what failed from what was skipped, since those are entirely different things, and lumping them together buries the handful of genuine errors underneath a wall of items that were never eligible for deletion in the first place.

The rate is the actual engineering problem

So what actually breaks first? You can write a loop that deletes 4,000 messages. It works. For a while. Then you start collecting 429s. Keep going and you earn an IP block that lasts an hour.

So every request goes through one queue, one at a time, with a delay between writes that the user cannot lower. Rate limit responses get read and honoured rather than retried blindly. Four in a row stop the run outright. Why stop, rather than simply back off further? Because at that point you are not unlucky. You are being told to stop, and continuing to generate them is precisely what turns a slow but entirely survivable job into an address that cannot talk to Discord for the next hour.

And the subtler version of the same bug? Two tabs. A second tab is a second queue. The service sees the sum. All that careful pacing is now running at exactly double the rate you designed. Clearline allows one working tab at a time; a second tells you so and offers to take over.

What falls out of all this

Once you accept that runs are slow and interruptible, the safety design mostly writes itself. You cannot reach the delete button without first seeing a count and the messages behind it. Runs over a hundred ask you to type the count back. Any run can be paused or stopped mid flight.

Order matters most at the end. The export is saved before the first deletion rather than alongside it, so that if the export is going to fail, it fails while the messages still exist. That ordering is the single most important decision in the whole thing, and it is the one I would keep if I had to throw out every other safeguard.

The honest caveat

Automating a user account is against Discord's terms of service, and people do get actioned for it. Careful pacing lowers the odds. It does not remove them. If losing the account would be a serious problem, export first and decide afterwards whether the deletion is worth it.

Clearline only ever touches messages you wrote yourself. It is free and MIT licensed. There is no account and no server behind it, and no telemetry anywhere in it.

It is not affiliated with, endorsed by, or connected to Discord Inc.