Discord bot token: where to find it and how to keep it safe

The token is the credential your code uses to sign in to Discord as the bot. There is no username and password: whoever holds the token can do everything the bot can, such as deleting channels, banning members and posting messages as the bot.

That gives the topic two halves. The first is finding the token. The second, the one that matters, is keeping it out of repositories, screenshots and support chats.

Where do you find the bot token?#

The token lives in the Discord Developer Portal:

1. Sign in to the Portal and open your application (or create one with New Application).
2. In the left menu, open the Bot tab.
3. Click Reset Token and confirm. The token appears on screen.
4. Copy it straight into the place where you will store it (see the section below).

If you close the page without copying it, you cannot read the value again: reset it once more and use the new token.

Every reset invalidates the bot's old tokens. That is useful when something goes wrong, but it also knocks offline any process still using the old value.

How is the token used?#

Every call to Discord's REST API carries the token in the Authorization header with the Bot prefix, according to the API reference. Libraries (discord.js, discord.py, JDA) do this for you when you pass the token at login. To see it in action, this command returns the bot's own user data:

curl -H "Authorization: Bot $DISCORD_TOKEN" https://discord.com/api/v10/users/@me

With a valid token, the response includes the bot's id and username. With a wrong or reset token, you get 401: Unauthorized. This is the quickest way to check that the value you copied works, without starting the whole bot.

How do you store the token safely?#

There is one rule: the token lives in the environment, not in code. In development that means a .env file that Git ignores. In production it means the host's environment variable. The article on environment variables explains the mechanics.

Create .env in the project root:

DISCORD_TOKEN=paste_the_token_here

And make Git ignore it before the first commit:

echo ".env" >> .gitignore
git status   # .env must not appear in the list

How do you read the token in Node.js?#

In recent Node.js versions, the --env-file flag loads .env without an extra package and is no longer experimental, per the Node.js documentation.

import { Client, Events, GatewayIntentBits } from "discord.js";

const token = process.env.DISCORD_TOKEN;
if (!token) {
  console.error("Set DISCORD_TOKEN in the environment.");
  process.exit(1);
}

const client = new Client({ intents: [GatewayIntentBits.Guilds] });
client.once(Events.ClientReady, (c) => console.log(`Online as ${c.user.tag}`));
client.login(token);

node --env-file=.env index.js

How do you read the token in Python?#

With discord.py 2.x and the python-dotenv package:

import os

import discord
from dotenv import load_dotenv

load_dotenv()
token = os.environ["DISCORD_TOKEN"]  # clear KeyError if missing

client = discord.Client(intents=discord.Intents.default())


@client.event
async def on_ready():
    print(f"Online as {client.user}")


client.run(token)

Using os.environ["..."] instead of os.getenv makes the program fail immediately, with a clear message, when the variable is missing.

What mistakes make a token leak?#

• Pasting the token into code. client.login("MTA...") works and looks harmless until the first git push.
• Committing .env. It happens when .gitignore is created after the first commit. The file is already in the history.
• Showing the token in a screenshot or log. A console.log(process.env) or a terminal screenshot posted to ask for help is enough.
• Sharing the project as a ZIP. .env travels with the folder.
• Sending the token in a message. In a support server, nobody needs your token to help you. Anyone who asks for it is a scammer.

GitHub scans repositories for Discord bot tokens: the discord_bot_token pattern is in the list of secret scanning patterns, with push protection and a partner alert. That helps, but do not treat it as your only defense, and do not assume Discord resets the token for you.

What do you do if the token leaked?#

Act in this order:

1. Reset the token now. Portal, Bot tab, Reset Token. The leaked value stops working immediately.
2. Update the new token on your host and in your local .env, then restart the bot.
3. Check your server. Look for channels, roles, webhooks or invites you did not create.
4. Clean the repository if you want (for example with git filter-repo), but only after step 1. Rewriting history does not help if the old value was already copied, which is why resetting comes first.

If your bot had the Administrator permission, the possible damage is larger. Give the bot only the permissions it needs.

If the bot stays offline after the swap, read why a Discord bot goes offline: an old token forgotten in some environment is a common cause.

How do you separate test and production tokens?#

Create two applications in the Portal: one for development and one for the bot that stays online. Each has its own token. A leak of the test token then does not take down the production bot, and you can test changes without touching the bot that is live.

Use the same variable name (DISCORD_TOKEN) in both environments and change only the value. The code does not need to know which is which. To take the bot to a host, follow the guide on how to host a discord.js bot.

How to do this on Square Cloud#

On Square Cloud the token does not need to sit in any project file. Environment variables are set per application, in the dashboard, through the API, the CLI or the VS Code extension. The dashboard also imports a .env and exports the set as KEY=VALUE.

Create a DISCORD_TOKEN variable with the value from the Portal and keep .env out of the ZIP and the repository. The change takes effect on the next restart, with no rebuild. If you need to swap the token after a leak, edit the value and restart.

Bot hosting supports discord.js, discord.py, JDA, Discord.Net or any Gateway library, and automatic restart (on by default for dashboard deploys) brings the bot back when the process exits with an error. You do the deploy and the configuration yourself. See the details on Discord bot hosting.