npm ci fails on one package

The build log names it and says why: a known-malicious version, a checksum mismatch, or a file over the size limit. Pin another version or remove it. Nothing installs at runtime, so you have to fix this before the deploy.

Can I use a .env file?

You can, but variables from the Secrets tab are already in process.env and are stored encrypted. A .env file sits in your project as plain text.

My bot answers slowly

Check the CPU line on the Usage tab. Half a CPU is plenty for a gateway bot, but heavy image or audio work will not fit.

How to host a discord.js bot

Hosting a discord.js bot means running node index.js somewhere that never turns off. HostDC does that on Node.js 20 or 22, with a free plan that gives a 256 MB RAM pool, 0.5 CPU and 512 MB storage.

1. Prepare the project

package.json
package-lock.json
index.js

Commit the lockfile. We then install exactly what you tested. Without one, the resolved tree can drift between deploys.

const { Client, GatewayIntentBits } = require('discord.js');
const client = new Client({ intents: [GatewayIntentBits.Guilds] });

client.once('clientReady', () => console.log(`Logged in as ${client.user.tag}`));
client.login(process.env.DISCORD_TOKEN);

2. Upload and deploy

Drop a zip, paste a GitHub URL, or write it in the editor. On deploy we read the lockfile and install every package through our proxy, which checks each version against the known-malicious list and its checksum. Install scripts never run.

3. Add the token

Paste it on the Secrets tab, away from your source. It arrives as process.env.DISCORD_TOKEN.

4. Register your slash commands

Run your registration script locally once, or do it on boot from your own code. Outbound calls to Discord are allowed from the sandbox, so REST.put(Routes.applicationCommands(...)) works.

5. Keep it online

Auto-restart handles crashes. You handle reactivation on Free, weekly. Paid plans (Mini, Lite, Pro and Max) never need it. The pricing page has the rest.

Last updated 2026-09-06