HostDC

Environment variables and bot tokens

A bot token is a password: anyone holding it can act as your bot. Keep it out of your source code and out of Git, and read it from an environment variable instead.

Set the token on the Secrets tab

Paste it once on your bot's Secrets tab. We encrypt it with AES-256-GCM, store the ciphertext, and inject it into the sandbox as DISCORD_TOKEN when the bot starts. We never show it again and the API never returns it. You replace it instead of reading it back.

client.login(process.env.DISCORD_TOKEN);

bot.run(os.environ["DISCORD_TOKEN"])

s, err := discordgo.New("Bot " + os.Getenv("DISCORD_TOKEN"))

Add your own variables

The same tab holds ordinary environment variables, such as an API base URL or a channel ID. We store them the same way, and they appear in your process alongside the token.

Two are set for you: HOSTDC_BOT_ID and HOSTDC_PLAN.

If a token leaks

Rotate it in the Discord developer portal first, then paste the new one on the Secrets tab and restart. We scrub console output on the node and again in the log hub, so a printed token does not reach the buffer. Treat that as a safety net rather than a plan.

Last updated 2026-09-06

FAQ

Can I hardcode the token instead?

You can, and it will work. It also means the token lives in your repository, your zip file and your backups, so we do not recommend it.

Can a collaborator read my token?

No. Nobody can read it back, including editors, viewers and admins. Only the owner can replace it.

Do I need python-dotenv or dotenv?

No. Variables set on the Secrets tab are already in the process environment.

Are environment variables visible in the console?

Not by us. If your own code prints them, that is your output, though we redact the token before it reaches the buffer.