# Apps and installs

> Applications, bot accounts, installs, scopes, intents, permissions and privileged access.

An **app** is something you build that runs on your own computer or server and talks to Lamma through its bot account. People add it to their servers with an install link.

## Applications

You make apps in **User Settings › Developer**. Each app has:

- A name (2 to 32 characters), a description (up to 400) and optional https links to a privacy policy and terms of service. People see these on the install screen.
- A **bot account** named `app_<id>`. It can't sign in to Lamma, has no password or passkey, and shows an **App** badge wherever its name appears. It never counts toward a server's member limit and can't be added as a friend.
- **What installs ask for**: its scopes, gateway intents and bot permissions.

You can have up to 25 apps. Deleting an app revokes every token and removes it from every server. Its old messages stay, shown as from "Deleted app".

## Installs

An install puts the app in one server. Anyone with **Manage server** can install it from the install link:

```
https://lammapp.sa/app?app=<application id>
```

The link opens an install screen built by Lamma. It shows the app, its developer, whether it has been reviewed, and each scope, intent and permission it asks for, with a plain list of what the developer will receive. Permissions the person installing doesn't have themselves can't be granted. If the app changes what it asks for while the screen is open, the install is refused and a fresh screen is shown, so people always approve what the app really gets.

Installing adds the bot to the server with a **managed role** holding exactly the approved permissions. Server managers can rename and move that role or take permissions away, but never add more than the install granted.

An install ends when someone removes the app in **Server settings › Apps**, kicks or bans the bot, or deletes the server, or when you delete the app. Every install and removal is written to the server's audit log. Apps can't be installed in Lamma's own community server.

## Scopes

Scopes say which parts of the [REST API](https://lammapp.sa/developers/api-reference) the app may use.

| Scope | Allows |
| --- | --- |
| `bot` | The bot account itself. Always required |
| `messages.send` | Sending, editing and deleting its own messages |
| `messages.read` | Reading message history |
| `reactions` | Adding and removing its own reactions |
| `commands` | [Slash commands](https://lammapp.sa/developers/commands). Asked for by default |
| `members.read` | Listing a server's members. Needs the `guild_members` intent |

A call outside the install's scopes answers `403` with `{"error": "missing_scope", "scope": "<name>"}`.

## Gateway intents

Intents say which [events](https://lammapp.sa/developers/events) the app receives. They are names, not a bitfield.

| Intent | Events |
| --- | --- |
| `guilds` | Server, role and channel changes |
| `guild_messages` | Messages sent, edited and deleted |
| `message_content` | The text, embeds, attachments and polls inside message events. **Privileged** |
| `guild_reactions` | Reactions added and removed |
| `guild_members` | Members joining, changing and leaving. **Privileged** |
| `guild_moderation` | Bans, timeouts and new audit log entries. Also needs the **View audit log** permission |
| `guild_expressions` | Custom emoji changes |

## Bot permissions

The bot's managed role can only hold permissions from this list: View channels, Send messages, Embed links, Attach files, Add reactions, Read message history, Mention everyone, Manage messages, Pin messages, Create polls, Bypass slowmode and View audit log. Administrator, server management, moderation and voice permissions aren't offered.

Everything the bot does still goes through Lamma's permission checks as its own account: channel permissions, Read message history, timeouts and slowmode apply to it like to anyone else. Scopes and intents can only narrow that.

## Privileged access

`message_content` and `guild_members` (and `members.read`, which follows it) are privileged. They work only:

- once Lamma has **reviewed** your app for them. Ask from **User Settings › Developer** in the app's **Review** section, or
- under the **development allowance**: in servers you own, up to five of them.

Both are checked on every request and every message event, so if approval is withdrawn or a server changes owner, the access ends at once, even on a gateway connection that is already open.

Without `message_content`, message events still carry the author, channel, time, mentions and reactions, but `content`, `embeds`, `attachments` and `poll` are empty and `content_available` is `false`. Messages that mention the bot directly, and messages the bot wrote, always include their text.

## Beta limits

| Limit | Value |
| --- | --- |
| Apps per developer | 25 |
| Servers per app before review | 25 |
| Development allowance | 5 servers you own |
| Installs | 10 an hour per person installing |