# Environment variables and bot tokens A bot token is a password: anyone holding it can act as your bot. Keep it out of your source code and out of Git, and read it from an environment variable instead. ## Set the token on the Secrets tab Paste it once on your bot's Secrets tab. We encrypt it with AES-256-GCM, store the ciphertext, and inject it into the sandbox as `DISCORD_TOKEN` when the bot starts. We never show it again and the API never returns it. You replace it instead of reading it back. ```js client.login(process.env.DISCORD_TOKEN); ``` ```python bot.run(os.environ["DISCORD_TOKEN"]) ``` ```go s, err := discordgo.New("Bot " + os.Getenv("DISCORD_TOKEN")) ``` ## Add your own variables The same tab holds ordinary environment variables, such as an API base URL or a channel ID. We store them the same way, and they appear in your process alongside the token. Two are set for you: `HOSTDC_BOT_ID` and `HOSTDC_PLAN`. ## If a token leaks Rotate it in the Discord developer portal first, then paste the new one on the Secrets tab and restart. We scrub console output on the node and again in the log hub, so a printed token does not reach the buffer. Treat that as a safety net rather than a plan. ## Related - [Host a discord.py bot](/host/discord-py) - [Host a discord.js bot](/host/discord-js) - [Pricing and plans](/pricing) ## FAQ ### Can I hardcode the token instead? You can, and it will work. It also means the token lives in your repository, your zip file and your backups, so we do not recommend it. ### Can a collaborator read my token? No. Nobody can read it back, including editors, viewers and admins. Only the owner can replace it. ### Do I need python-dotenv or dotenv? No. Variables set on the Secrets tab are already in the process environment. ### Are environment variables visible in the console? Not by us. If your own code prints them, that is your output, though we redact the token before it reaches the buffer.