Keeping your Discord bot token safe

5 minute read

What a leaked token lets someone do

A bot token is full authentication. With it, somebody can run their own code as your bot: read the channels it can see, send messages, ban or kick members if it has those permissions, delete channels, and spam every server your bot is in. Server owners will blame your bot, and Discord may act against it.

There is no password prompt and no warning. The only defence is not leaking it, and regenerating it quickly if you do.

How tokens actually leak

• Pushed to GitHub. By far the most common. A token hardcoded in bot.py or committed in a .env file. Automated scanners find public tokens within minutes.
• Pasted into a screenshot or support message. Including in error output that prints your configuration.
• Shared project files. Sending a friend the folder, or uploading it to a paste site to ask for help.
• Anyone with access to where the bot runs. On any host, people you give access to the server can usually read its configuration, including the token.

Storing it safely

Keep the token in an environment variable and read it at runtime:

import os
TOKEN = os.environ["BOT_TOKEN"]

For local development a .env file is convenient, but add it to .gitignore before your first commit:

# .gitignore
.env

Then load it with python-dotenv:

from dotenv import load_dotenv
import os

load_dotenv()
TOKEN = os.environ["BOT_TOKEN"]

Already committed it?

Deleting the file in a new commit does not remove it. It is still in your repository's history, and anyone can read it there. Treat the token as leaked and regenerate it, even if you delete the commit.

If your token leaks, do this immediately

1. Open the Discord Developer Portal, choose your application, go to Bot, and press Reset Token. The old token stops working at once.
2. Put the new token wherever your bot runs, and restart it.
3. Check the servers your bot is in for damage: deleted channels, bans, strange messages.
4. Remove the leaked token from wherever it was published.

Discord sometimes resets a token automatically when it is found in a public GitHub repository and sends you a message. If your bot suddenly cannot log in, check for that first.

Limit the damage in advance

• Least privilege. Invite the bot with only the permissions it needs. A bot that only posts messages should not have Administrator.
• Be careful who gets server access. Only give people access to where your bot runs if you would trust them with the token.
• Separate bots for testing. Use a different application and token while developing, so a leaked test token cannot touch real servers.

On SnowServers

The token goes in the Bot token box on the Startup tab, never in your files, so it is not in your uploads or in anything you share for support. Anyone you add as a user on your server can see it, which is how every control panel works, so only add people you trust. More in our discord.py hosting guide.