Keep your bot token safe with environment variables

Your bot token is the password for your bot. Anyone who has it can control the bot. Keep it out of your code by storing it in a .env file and reading it as an environment variable.

Step 1: Create a .env file

1. In the Game Panel, open your bot and go to Files.

2. Create a new file named exactly .env in the main folder (next to your main file).

3. Add your token like this, with no spaces or quotes around the equals sign:

   DISCORD_TOKEN=paste-your-token-here

   Copy

4. Save the file.

You can put other secrets in the same file, one per line, such as a database password or an API key.

Step 2: Read the token in your code

Node.js

Add the dotenv package to your package.json (run npm install dotenv on your computer, or add it to the dependencies). Then, at the very top of your main file:

require('dotenv').config();
// or, if you use ES modules:
// import 'dotenv/config';

client.login(process.env.DISCORD_TOKEN);

Python

Add python-dotenv to your requirements.txt. Then in your main file:

import os
from dotenv import load_dotenv

load_dotenv()
token = os.getenv("DISCORD_TOKEN")
bot.run(token)

Restart the bot. If it logs in, the token is being read correctly. If you get an "invalid token" error, check the spelling of the variable name in both places.

Step 3: Never share or commit the token

• If you use Git, add a line with .env to your .gitignore file so it is never uploaded to GitHub. If your Node.js bot deploys from GitHub (the Git Repo Address setting in Startup), create the .env file on the server with Files instead.

• The Git Access Token you enter in Startup for a private repo is a secret too. Give it access to only the repo the bot needs, and revoke it on GitHub if it leaks.

• Never paste the token in Discord, screenshots, YouTube videos, or help forums. When asking for help, remove it first.

• Don't send your files to people you don't trust. A bot's folder usually contains its .env.

• Need a friend to help with your bot? Don't share your Game Panel or billing login. Add them in Users with only the permissions they need. See How to add sub-users.

If your token leaks: reset it now

1. Go to the Discord Developer Portal and open your application.

2. Open Bot and click Reset Token. Confirm (you may be asked for your 2FA code).

3. Copy the new token. The old one stops working straight away.

4. Paste the new token into your .env file on the server and restart the bot.

5. Check your Discord servers for anything the attacker may have done, and change your Game Panel password if you think your panel was accessed.

Frequently asked questions