Discord bot token security: what to do and what to avoid

The bot token is the key to the bot. Anyone who has it can log in as the bot and do everything the bot is allowed to do in every server it is in. Protecting it is the most important security task of a bot owner.

What a leaked token allows

With your token an attacker can read what the bot can read, send messages as the bot, and use any permission the bot has, such as banning members or deleting channels. This is why an Administrator bot makes a leak so dangerous.

Where the token belongs

• In an environment variable on the machine or the host that runs the bot.
• In a .env file that is only on that machine and is never committed.
• Never in the source code, a screenshot, a chat message or a public repository.

A BotsMaker project reads process.env.DISCORD_TOKEN and ships a .gitignore that excludes the .env file and the data folder. You never paste your token into the BotsMaker site, because it does not need it.

If the token leaks

1. Open the Developer Portal, the Bot tab, and press Reset Token. The old token stops working at once.
2. Put the new token into your environment on the host.
3. Check the audit log of your server for actions you did not do.
4. Find out how it leaked and fix that.

Habits that protect the bot

• Give the bot only the permissions it needs.
• Do not run code you do not understand from strangers. Bot code can contain a line that sends your token away.
• Keep Node.js and the dependencies updated.
• Use two-factor authentication on the Discord account that owns the application.
• Use a team in the Developer Portal if several people maintain the bot.

What the generated code never does

BotsMaker refuses to generate code that reads the token to send it somewhere, that logs it, that uses user tokens or self-bot behavior, or that runs shell commands. The safety scan rejects such code before it reaches you.