Keeping your bot token out of trouble

Discord Bots Reviewed September 6, 2026 2 min read

A bot token is not a password you can change while keeping the session. It is the whole identity: whoever holds it can do everything your bot can do, in every server your bot is in, without any further check.

The four ways tokens leak

  • Hardcoded in a file that gets pushed to a public repository.
  • Pasted into a Discord message or a screenshot while asking for help.
  • Left in a .env that was included in a zip shared with someone.
  • Printed to the console by a debug line that was never removed.

Storing it properly

  1. Use an environment variable

    Set it in the panel's startup variables. Your code reads process.env.TOKEN or os.environ["TOKEN"] and never contains the value itself.

  2. Or a .env file that stays on the server

    With dotenv in Node or python-dotenv in Python. Add .env to .gitignore in the same commit that creates it, not later.

  3. Never log it

    Not even during debugging. Console output ends up in screenshots, support tickets and logs you forget about.

If it leaked, regenerate it now and worry about how afterwards

In the Discord Developer Portal, Bot → Reset Token. This invalidates the old one immediately. Then update it wherever your bot reads it and restart. Do this before investigating — an exposed token is being scanned for by bots within minutes, not days.

Discord often catches it before you do

Discord scans public repositories for tokens and invalidates the ones it finds. If your bot suddenly cannot log in and you did nothing, check your email — that is usually what happened, and it did you a favour.

Related questions

Does resetting the token remove the bot from servers?
No. The bot stays in every server. Only the credential changes.
Can I have two tokens for one bot?
No. There is one, and resetting it invalidates the previous one.
Is the client secret the same thing?
No, that is for OAuth. Keep it private too, but the token is what runs the bot.