Your Discord bot token: where to keep it and what to do if it leaks

What the token is (and what it isn't)

You get it at discord.com/developers/applications, in your application → “Bot” → “Reset Token”, and it's a long string in three parts separated by dots. Your code hands it to Discord when it connects (client.run in discord.py, client.login in discord.js) and Discord asks for nothing else: not your password, not your two-factor code.

Don't confuse it with the “Client Secret” on the “OAuth2” tab: that one is for websites that log in with Discord, it's shorter and a bot won't start with it. Nor with the “Application ID”, which is public (it goes in the invite link).

There's another string that's just as secret even if it doesn't look like it: a webhook URL (https://discord.com/api/webhooks/…). Whoever has it can post in that channel with any name and picture they like. Treat it like the token.

Where to keep it: a .env that never goes to GitHub

The safe way is for the token not to be in the code: in a separate .env file the bot reads at startup (with python-dotenv in Python and dotenv in Node.js, as in your first bot in Python or in JavaScript), plus a .gitignore that tells Git never to push it.

DISCORD_TOKEN=paste-your-token-here

.env
node_modules/
__pycache__/
.venv/

1. Create the .gitignore before the first commit

   If the .env was pushed once, adding it to .gitignore afterwards doesn't remove it: Git keeps tracking it. Take it out with git rm --cached .env, commit and, since it was already public, change the token (below).

2. Check what you're about to push

   git status before every commit: if .env is on the list, stop. On GitHub, check the file doesn't show up on the repository page.

3. Leave an example without the token

   A .env.example with an empty DISCORD_TOKEN= tells anyone using your code what to fill in, without giving away yours.

How it leaks (almost always)

Pushed to a public GitHub repository, in the code or in the .env. It's by far the most common way, and GitHub detects it: it scans public code for Discord tokens and tells Discord, which can revoke it. If one day your bot stops connecting with “Improper token has been passed” (discord.py) or “TokenInvalid” (discord.js) and you had just pushed something, this is almost certainly why: check your Discord direct messages and your email.

Deleting it in a new commit doesn't help: it's still in the history, and anyone who cloned or forked it has it. It doesn't matter if the repository was public for five minutes: there are programs that read everything published on GitHub looking for tokens.

The other ways: a screenshot of your code or your .env when asking for help, pasting the whole code in a forum or a Discord server, or installing a fake package. Packages with names close to the real ones turn up on PyPI and npm from time to time, looking for tokens on your computer and sending them off: install libraries by their exact name (discord.py, discord.js) and distrust “tools” that ask for your token to do something for you.

It leaked: what to do, in this order

1. Change the token now

   Developer portal → your application → “Bot” → “Reset Token”. The old one stops working at that moment, wherever it is. It's the only thing that really fixes it; everything else is cleaning up. If you have two-factor authentication on, Discord will ask for the code.

2. Put the new one in your .env and restart the bot

   The token is only read at startup: until you restart, your bot keeps trying to log in with the old one.

3. Remove the old one from where it was

   From the code, from the .env you pushed (git rm --cached .env and commit) and from wherever you pasted it. Rewriting Git history is optional: the old one no longer works, so what matters is that the new one doesn't go the same way.

4. See what the bot has done

   On every server it's in, “Server Settings” → “Audit Log”, filtering by your bot: deleted channels, changed roles, kicked members or mass messages. If someone used it, it shows there, and the messages it sent are still in the channels.

5. Review the application

   In the portal: that “Public Bot” is set the way you want (if it's on, anyone can add your bot to their server), that the team (“Teams”) that manages it has nobody extra and that the “OAuth2” and webhook URLs are yours.

6. If there were webhooks in the code, change them too

   Resetting the bot token doesn't fix a webhook: delete it in “Edit Channel” → “Integrations” → “Webhooks” and create another.

Making a stolen token do as little harm as possible

Whoever has the token can do exactly what the bot is allowed to do, no more, no less. A stolen bot with “Administrator” can wipe the whole server; one that can only read and write in two channels, little more than send messages. Give it only the permissions it uses: with the bot permissions calculator you tick the ones it needs and get the invite link with just those.

Same with the privileged intents (members, presence and message content): turn them on in the portal only if your code uses them (what each one does and which you need).

And if the bot is only for your server and your friends, turn off “Public Bot”: that way nobody else can add it to other servers under your name.

If your bot is on NapNodes

The token goes in your code, for example in the .env, never in the panel: the panel has no field for it and doesn't need it. If you upload your code in “Files”, upload the .env with it. If you pull it from GitHub (“Settings” → “GitHub repository”), the .env isn't in the repository (because of the .gitignore), so upload it separately in “Files”: when pulling changes from the repository, Git doesn't touch files it doesn't track.

If your repository is private, the panel asks for a username and a “GitHub token”: that's a different token, from GitHub, not the Discord one. The safest is a fine-grained one (Settings → Developer settings → Fine-grained tokens) for that repository only and with read-only access to contents: that's all it needs to download the code.

After changing the token, upload it to the .env in “Files” and press “Restart”: the “Console” should show your “Logged in as…”. If you have nowhere to host it, there's a free 256 MB bot that stays online, which you only have to renew with one click every week.

Frequently asked questions