How to create a Discord bot and keep its token safe

Every Discord bot has a token, a long secret string that proves the program is allowed to act as that bot. Anyone who holds the token controls the bot completely: they can send messages as it, read what it can read, and use any permission you gave it. Creating the bot takes five minutes. Keeping the token private is the part that deserves care.

Create the application

  1. Go to the Discord Developer Portal and sign in with your Discord account.
  2. Click New Application, give it a name and accept the terms.
  3. Open the Bot tab in the left menu. Discord creates the bot user for you.
  4. Set the bot's name and icon, which is what members see.

The application also has a client ID (sometimes called the application ID), which you will need to invite the bot.

Get the token

On the Bot tab, click Reset Token, confirm, and copy the token that appears. Discord shows it once. If you lose it, you reset it again and get a new one, which makes the old token stop working immediately.

Put it somewhere safe straight away: in a password manager, or directly in the place your bot will read it from. Do not paste it into a chat, a ticket or a screenshot.

Invite the bot to a server

  1. Open the OAuth2 section, and the URL generator.
  2. Tick the bot scope, and the applications.commands scope if your bot uses slash commands.
  3. Tick only the permissions the bot needs. Starting with the minimum, such as sending messages and reading channels, is safer than choosing Administrator.
  4. Copy the generated link, open it, and choose a server where you have permission to add bots.

Giving a bot Administrator is convenient and dangerous. If the token leaks, an attacker has full control of your whole server. Choose specific permissions, and see Secure your bot and its permissions for more.

Never put the token in your code

The classic mistake is writing the token into a source file, then uploading the project to a public repository. Automated scanners find leaked tokens within minutes, and attackers use them to spam servers or take over bots. Discord often detects tokens posted on public sites and resets them, and your bot goes offline with an invalid token error.

Keep the token out of your code instead:

  • Environment variables. The program reads the token from its environment at start-up. Your hosting panel usually has a place to set them. See Environment variables and keeping your bot token safe.
  • A separate config file that is listed in .gitignore, so version control never includes it.
  • A secrets manager, for larger setups.

In code, you read the variable, for example process.env.TOKEN in Node.js or os.environ["TOKEN"] in Python, rather than writing the token as text.

Rules to live by

  1. One token, one bot. Do not reuse it across projects.
  2. Never share it, even with friends helping you, since a friend can leak it by accident. Give them their own test bot.
  3. Do not commit it. Check your history if you ever did, because deleting the file does not remove it from past versions.
  4. Reset it at once if you suspect it leaked. Doing it takes seconds, and it is always better to reset too soon.
  5. Limit who has access to your hosting panel and your developer team, and use two-factor authentication on your Discord and hosting accounts. See Enable two-factor authentication (2FA) and passkeys.

What to do if the token leaks

  1. Reset the token in the Developer Portal. This cuts off the attacker.
  2. Update the new token in your hosting settings and restart.
  3. Check your server's audit log for actions you did not make, such as new webhooks, roles or channels.
  4. Look at the bot's permissions and reduce them if they are too broad.
  5. Find out how it leaked, and fix that.

If the bot suddenly stops working with an authentication error, a reset token is one of the first things to check. Fixing invalid token errors on your Discord bot walks through the causes.

Test bot and live bot

Create a second application for testing, with its own token. Develop and break things there, and keep the live bot's token only on the live server. It prevents a lot of accidents.

When you are ready to host it, Deploy a Node.js Discord bot and Deploy a Python bot show how to upload your code and set the variables.

Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.