Any chance this can be used to token-log people's accounts?

It looks like only k-id's session token is transmitted back to the site, which can't be used to authenticate to Discord.

You can also self-host the backend from https://github.com/xyzeva/k-id-age-verifier.