---
title: "Keep your bot token safe with environment variables"
url: https://help.endercloud.in/docs/keep-your-bot-token-safe-with-environment-variables
category: "Bot Hosting"
type: Guide
tags: ["bots", "discord", "security"]
keywords: "bot token leaked, reset bot token, .env file, dotenv, process.env, os.getenv, python-dotenv, gitignore, token hacked, bot hacked, discord developer portal token, bot token, hide bot token, environment variables, env file, token leaked github, secure bot token, how to store token, reset discord token"
difficulty: beginner
time: "5 minutes"
updated: 2026-11-14
source: Endercloud Knowledge Base (official)
---

# Keep your bot token safe with environment variables

> Put your bot token in a .env file, load it with dotenv (Node.js) or python-dotenv (Python), never commit it to GitHub, and reset it at once if it leaks.

Your bot token is the password for your bot. Anyone who has it can control the bot. Keep it out of your code by storing it in a `.env` file and reading it as an environment variable.

## Step 1: Create a .env file

1.  In the [Game Panel](https://panel.endercloud.in), open your bot and go to **Files**.
    
2.  Create a new file named exactly `.env` in the main folder (next to your main file).
    
3.  Add your token like this, with no spaces or quotes around the equals sign:
    
    ```
    DISCORD_TOKEN=paste-your-token-here
    ```
    
4.  Save the file.
    

You can put other secrets in the same file, one per line, such as a database password or an API key.

## Step 2: Read the token in your code

### Node.js

Add the `dotenv` package to your `package.json` (run `npm install dotenv` on your computer, or add it to the dependencies). Then, at the very top of your main file:

```
require('dotenv').config();
// or, if you use ES modules:
// import 'dotenv/config';

client.login(process.env.DISCORD_TOKEN);
```

### Python

Add `python-dotenv` to your `requirements.txt`. Then in your main file:

```
import os
from dotenv import load_dotenv

load_dotenv()
token = os.getenv("DISCORD_TOKEN")
bot.run(token)
```

Restart the bot. If it logs in, the token is being read correctly. If you get an "invalid token" error, check the spelling of the variable name in both places.

## Step 3: Never share or commit the token

-   If you use Git, add a line with `.env` to your `.gitignore` file so it is never uploaded to GitHub. If your Node.js bot deploys from GitHub (the **Git Repo Address** setting in **Startup**), create the `.env` file on the server with **Files** instead.
    
-   The **Git Access Token** you enter in **Startup** for a private repo is a secret too. Give it access to only the repo the bot needs, and revoke it on GitHub if it leaks.
    
-   Never paste the token in Discord, screenshots, YouTube videos, or help forums. When asking for help, remove it first.
    
-   Don't send your files to people you don't trust. A bot's folder usually contains its `.env`.
    
-   Need a friend to help with your bot? Don't share your Game Panel or billing login. Add them in **Users** with only the permissions they need. See [How to add sub-users](/docs/how-to-add-sub-users).
    

## If your token leaks: reset it now

1.  Go to the [Discord Developer Portal](https://discord.com/developers/applications) and open your application.
    
2.  Open **Bot** and click **Reset Token**. Confirm (you may be asked for your 2FA code).
    
3.  Copy the new token. The old one stops working straight away.
    
4.  Paste the new token into your `.env` file on the server and restart the bot.
    
5.  Check your Discord servers for anything the attacker may have done, and change your Game Panel password if you think your panel was accessed.
    

> **Note:**
> Discord can reset tokens automatically when it finds them posted publicly, for example on GitHub. If your bot suddenly says the token is invalid, that may be why. Generate a new one and keep it in `.env` this time.

## Frequently asked questions

**Q: Can Endercloud staff see my token?**

Our staff don't read or change your files. You are responsible for your account security, so turn on two-factor authentication and don't share your login.

**Q: I can't see the .env file in my SFTP program**

Files whose name starts with a dot count as hidden on many systems. Turn on the option to show hidden files in your SFTP program or on your computer, or check in the panel's **Files** page.

**Q: Is it safe to put the token directly in config.json?**

It works, but it's easy to share by accident. If you do it, make sure the file is never uploaded to GitHub or sent to anyone.