How do I keep my bot token secure?
Your bot token is equivalent to a password. Anyone with the token can control your bot, send messages, and perform any action the bot has permission to do.
Never put the token in your code files. Use the Startup page environment variables instead; it's injected directly into your process at runtime without ever appearing in your file tree.
Do not commit your token to a GitHub repository. If you accidentally expose a token, go to the Discord Developer Portal immediately, open your application's Bot page, and click "Regenerate" under the token. Update the Startup variable in the panel with the new token.
If your bot is behaving unexpectedly (sending messages you did not trigger, joining servers on its own), assume the token is compromised, so regenerate it immediately.
Want to try this on a real server?
Everything described here is available on the trial too, on the same hardware and the same panel as the paid plans. Try it free for 24-hour, no credit card required.
Didn't fix it? Ask in Discord.
Ask in our Discord - we help with hosting questions whether or not you host with us.