HostDC

How to Keep Your Discord Bot Token Safe With Environment Variables

Guide · · 3 min read · discord, discord-bots, security, environment-variables, python, node.js, bot-hosting

Written with AI help.

Your bot token is the password to your bot. Anyone who has it can log in as the bot and act as it, so it should never sit in your source code or in a Git repository. This guide covers storing it in an environment variable, loading it from a .env file, keeping that file out of Git, and replacing the token after a leak.

Keep the token out of your code

Discord's OAuth2 documentation tells developers to make sure their info is not in their source code. The fix is to read the token from an environment variable at start-up. Your code then holds only the variable name, and the value lives outside the repository, set on the machine or kept in a file that never gets committed.

A common name is DISCORD_TOKEN. The name is your choice, as long as the code and the environment agree on it.

Create a .env file

A .env file has one KEY=value pair per line:

DISCORD_TOKEN=paste-your-token-here

Use a placeholder in anything you share. Never paste a real token into a chat, a screenshot, an issue or a code sample.

Load it in Python

Install python-dotenv, then call load_dotenv() before you read the variable:

pip install python-dotenv

import os
from dotenv import load_dotenv

load_dotenv()  # reads variables from a .env file and sets them in os.environ
token = os.environ["DISCORD_TOKEN"]

Using os.environ["DISCORD_TOKEN"] makes the bot fail with a KeyError at start-up if the variable is missing, which is easier to debug than a login error later. Pass token to your client's run() call.

Load it in Node.js

Node.js can read a .env file without any package. The --env-file flag was added in v20.6.0 and loads the file into process.env:

node --env-file=.env index.js

If a variable is set both in the real environment and in the file, the environment value wins. Node.js throws an error if the file does not exist. Use --env-file-if-exists=.env if the file should be optional; that flag was added in v22.9.0.

In your code, read the value from process.env:

const token = process.env.DISCORD_TOKEN;

Keep .env out of Git

The python-dotenv documentation says you will probably want to add .env to your .gitignore, especially if it contains secrets. Add this line to .gitignore:

.env

A .gitignore rule does not affect a file Git already tracks. GitHub's documentation says you must untrack a file that is already checked in before an ignore rule applies to it:

git rm --cached .env

This stops Git tracking the file but leaves it on disk. The token is still in your earlier commits, so if .env was ever committed and pushed, treat the token as leaked and reset it.

Reset a leaked token

Resetting the token makes the old one useless. In the Developer Portal:

  1. Open https://discord.com/developers/applications/ and select your application.
  2. Under Bot, choose Reset Token.
  3. Confirm, and enter your 2FA code if asked.
  4. Put the new token in your .env file or your host's secrets settings, then restart the bot.

GitHub and Discord work together to scan public gists for tokens and reset them when they are found, so a token that leaks in a public gist may already have been reset by the time you notice. Do not rely on that. If you posted a token anywhere public, reset it yourself.

Set the variable on your host

On a bot host, the token belongs in the host's secrets or environment settings, not in a file you upload with your code. On HostDC, the Secrets tab of a bot page takes your variables, and you can paste a whole .env file there to set many at once. Your code reads them the same way as above.

Sources

More posts