What is a Discord bot token? How to get, store and reset it safely

A Discord bot token is the password your bot uses to log in to Discord. You get it in the Discord Developer Portal: open your app, go to the Bot page and click Reset Token. Discord shows the new token once, so copy it straight into an environment variable or a password manager. Anyone who has the token can act as your bot in every server it's in, so it never goes in your code, a screenshot or a chat message. If it leaks, you reset it and the old one stops working.

This guide covers what the token is and how it differs from the client secret, application ID and public key, how to store it on your computer and on a host, what each token error means, and how to give a developer access without handing over your account. Everything was checked against Discord's developer docs and help center in September 2026. The code was tested with discord.js 14.27.0 on Node.js 24.15.0 and discord.py 2.7.1 with python-dotenv 1.2.3 on Python 3.14.3.

What a Discord bot token is

Every Discord app can have a bot user, and the bot token is how that bot user proves who it is. Discord's API reference lists three ways to authenticate: a bot token for bots, an OAuth2 bearer token for acting on behalf of a user, and the client ID and secret for OAuth2's own token endpoints. Your library sends the bot token with every API request as Authorization: Bot <token>, and again when it opens the gateway connection that puts the bot online. discord.js and discord.py add the Bot prefix themselves, so store the bare token.

Discord doesn't document the format and could change it. The example tokens in its API reference and in the discord.js guide both have three parts separated by dots, and in both the first part is an ID in Base64. Discord's example starts with MTk4NjIyNDgzNDcxOTI1MjQ4, which decodes to 198622483471925248, the same number its Basic auth example uses as the client ID. Application IDs are public, so that part only identifies the app. Treat the whole string as secret anyway.

What someone can do with your token

Discord's docs say the token carries your app's permissions. Whoever has it can log in as your bot and do anything the bot's roles allow, in every server it has joined: read the channels it can see, post and send DMs as your bot, and, where its roles allow it, delete channels, change roles or ban members. A bot with Administrator, which "allows all permissions and bypasses channel permission overwrites," hands over the whole server.

That's the practical case for least privilege. Give the bot only the permissions its features use, and a leaked token can only do that much. The permissions calculator builds an invite link with exactly the permissions you tick.

How to get your Discord bot token

1. Open the Developer Portal and select your app, or create one with New Application.
2. Click Bot in the left sidebar.
3. Under Token, click Reset Token and confirm the pop-up.
4. Enter your two-factor authentication code if Discord asks for it.
5. Copy the token and put it straight into your .env file, your host's settings or a password manager.

You click Reset Token even for a brand-new app, because that's how Discord's own quick-start generates the first token.

Why Discord shows it only once

Discord's help article about the missing copy button explains it: "After you have viewed the token once and leave the page, you no longer have access to it. This is put in place for security reasons." Nobody can look up an existing token later, you included.

That also answers "where is my Discord bot token?" If it isn't in your .env file, your host's settings or your password manager, it's gone, and a reset is the only way to get one that works. The reset invalidates the old token, so update every place it was used.

Bot token vs client secret, application ID and public key

The portal shows several values that look alike, and only one of them logs a bot in:

The discord.js guide shows the difference: a token has three parts separated by dots, and a shorter string with no dots is the client secret. Pasting the client secret where the token belongs gets the same "invalid token" error as a typo.

A user token is not a bot token

Your personal Discord account also has a login token, and you should never give it to anyone. Discord says automating user accounts, "generally called 'self-bots'," is forbidden and "can result in an account termination if found." Its Developer Policy bars apps from asking users for "passwords or account access or login tokens." Anyone asking for your user token, whether it's a "verification" bot, a giveaway or a helper in your DMs, is trying to take over your account. I don't build selfbots, and a legitimate bot never needs one.

How to store a bot token safely

Discord's quick-start says to "never share your token or check it into any kind of version control." Its Developer Terms go further: credentials "may not be embedded in open source projects," and tokens have to be kept "encrypted in any files or other materials accessible by third parties." In practice that comes down to three habits.

On your computer, keep it in a .env file that Git ignores. Put the token in .env in the bot's folder:

DISCORD_TOKEN=paste-your-bot-token-here

Add the file to .gitignore before your first commit, not after:

.env
node_modules/
.venv/

Commit a .env.example with the same variable names and empty values, so the next developer knows what to set without seeing yours.

On a host, use its secret settings. Every host worth using has a place for environment variables outside the repository. On Railway it's Variables, and a sealed variable's value "is never visible in the UI nor can it be retrieved via the API." On Render it's the service's Environment page, which can also hold secret files that appear at /etc/secrets/<filename>. Paste only the token, with no quotes and no line break after it. In my tests, a token wrapped in quotes in a host variable was rejected as invalid by both libraries. A trailing line break made discord.js fail with invalid Authorization header unless the code trims the value, as the files below do; discord.py strips it on its own. The 24/7 hosting guide compares hosts.

Keep it out of everything else. The token never belongs in:

• Browser or mobile app code. Anything that ships to a user's device can be read, so calls that need the token go through your server.
• Screenshots, screen recordings and streams of the Developer Portal or your editor.
• Support questions. Paste the error message, not your .env file.
• Logs and error reports. Don't print process.env, os.environ or your client's options.
• Platforms you don't trust. Pasting the token into a bot builder or an AI agent gives that platform full control of the bot. The BotGhost alternatives guide covers the 2025 incident in which, according to BotGhost's founder, Discord reset about 31,000 bots. If you connect an agent, the OpenClaw and Hermes Agent guides show where the token goes.

For a copy you may need again, Discord's docs suggest a password manager.

Load the token from the environment

Both files below read DISCORD_TOKEN, stop with a plain explanation when it's missing, warn when the value doesn't look like a bot token, and turn Discord's rejection into an instruction.

discord.js 14, CommonJS. Install with npm install discord.js and start it with node bot.js from the bot's folder:

const { Client, Events, GatewayIntentBits } = require('discord.js');

// Load .env when it exists (Node 20.12 or newer). On a host there is usually no
// .env file: the variable comes from the host's settings, and it wins over the file.
try {
  process.loadEnvFile();
} catch {
  // No .env file here, which is fine if DISCORD_TOKEN is set some other way.
}

const token = process.env.DISCORD_TOKEN?.trim();

if (!token) {
  console.error('DISCORD_TOKEN is not set. Add it to .env, or to your host\'s environment variables.');
  process.exit(1);
}

// Discord doesn't document the format, but a bot token has three parts separated by dots.
if (token.split('.').length !== 3) {
  console.warn('DISCORD_TOKEN doesn\'t look like a bot token. Copy it from the Bot page, not the OAuth2 page.');
}

const client = new Client({ intents: [GatewayIntentBits.Guilds] });

client.once(Events.ClientReady, (c) => {
  console.log(`Logged in as ${c.user.tag}, application ID ${c.application.id}`);
});

client.login(token).catch((error) => {
  if (error.code === 'TokenInvalid') {
    console.error('Discord rejected the token. It was reset or copied wrong: reset it on the Bot page and update DISCORD_TOKEN.');
  } else {
    console.error('Login failed:', error.message);
  }
  process.exit(1);
});

discord.py. Install with pip install discord.py python-dotenv and start it with python bot.py:

import os
import sys

import discord
from dotenv import load_dotenv

# Reads .env if there is one. Variables already set by your host are not overwritten.
load_dotenv()

token = os.getenv("DISCORD_TOKEN", "").strip()

if not token:
    sys.exit("DISCORD_TOKEN is not set. Add it to .env, or to your host's environment variables.")

# Discord doesn't document the format, but a bot token has three parts separated by dots.
if token.count(".") != 2:
    print("DISCORD_TOKEN doesn't look like a bot token. Copy it from the Bot page, not the OAuth2 page.")

client = discord.Client(intents=discord.Intents.default())


@client.event
async def on_ready():
    print(f"Logged in as {client.user}, application ID {client.application_id}")


try:
    client.run(token)
except discord.LoginFailure:
    sys.exit("Discord rejected the token. It was reset or copied wrong: reset it on the Bot page and update DISCORD_TOKEN.")

The format check only warns, because a future token format shouldn't stop your bot. One difference between the two: Node's process.loadEnvFile() reads .env from the folder you start the bot in, while python-dotenv starts in the script's folder and then searches the folders above it. Both leave variables that are already set alone, so on a host the value from its settings wins over a stale .env file.

What the two files print:

A test can't log in to Discord without a real token, so I ran both files unchanged against a local stand-in for Discord's API and gateway. It accepts one token and answers every other one with 401 Unauthorized, as Discord does. Every row above is real output from that test, along with loading the token from .env, from a host variable, and a host variable overriding a stale .env.

Token errors and what they mean

If the token worked yesterday and fails today, it was reset: by someone on your team, by Discord after a leak, or by Discord after too many logins. The bot not working guide covers the offline symptoms that come with it.

When to reset your Discord bot token

Reset it straight away when:

• it was committed, pasted, streamed or screenshotted anywhere public,
• a developer, builder platform or host that had it shouldn't have it any more,
• a second copy of the bot is running somewhere you can't find,
• the bot does things nobody on your team did.

Resetting changes only the login. The bot keeps its name, avatar, servers, roles and commands. The discord.js guide puts the other side plainly: a reset "will invalidate all old tokens belonging to your bot," so every program using the old one loses access at once, including the copy you forgot about. Have the new token ready to paste into your host.

When Discord resets it for you

Two things reset a token without anyone pressing the button:

1. It showed up on GitHub. Discord is in GitHub's secret scanning partner program for the "Discord Bot Token" pattern. GitHub scans public repositories, public npm packages, gists, issues, pull requests, discussions and wikis, and sends matches to the provider, who "decides whether they should revoke the secret." For Discord bot tokens that means a reset, as the discord.js team's leak explainer describes. GitHub's push protection also covers the pattern and is on by default for pushes to public repositories, so a push containing a token is blocked unless you choose to bypass the warning.
2. The bot logged in too often. Discord allows 1,000 IDENTIFY calls in 24 hours. Past that, "all active sessions for the app will be terminated, the bot token will be reset, and the owner will receive an email notification." A bot stuck in a crash loop that restarts every minute makes 1,440 attempts a day.

Don't treat either as a safety net. GitHub's partner scanning doesn't cover private repositories, and Discord doesn't document scanning anywhere else.

If your token leaked

1. Reset it and put the new token in your host's settings, then restart the bot.
2. Check the audit log of each server under Server Settings > Audit Log, filtered to your bot. Discord keeps entries for 45 days, and they record administrative actions such as bans, role changes and deleted channels. Messages the bot sent don't show up there.
3. Rotate its neighbors. A leaked .env file usually holds database passwords and API keys too.
4. Clean the Git history if you want to, but only after the reset. A rewrite doesn't reach clones and forks that already have the token, while the reset makes every copy useless.
5. Trim the bot's permissions to what its features use, so the next leak does less damage.

Two-factor authentication and team ownership

Turn on two-factor authentication for the Discord account that owns the app. Discord can ask for the code when you reset a token, and you can't create or join a developer team without it. Servers that require 2FA for moderation also check the bot owner's account: Discord enforces 2FA on the owner "when added to guilds that have server-wide 2FA enabled" for elevated permissions such as Kick Members, Ban Members, Manage Roles, Manage Channels and Administrator.

If more than one person looks after the bot, move the app into a developer team. Create the team from the Teams page of the Developer Portal, then use Transfer App to Team at the bottom of the app's General Information page. The transfer can't be undone, and a team can own up to 75 apps. Team roles decide who can touch the token, and each role has the access of the ones below it:

No role can view an existing token. A member who resets it sees the new one, which is the only way anyone gets a token at all.

Giving a developer access without sharing your account

Never give anyone your Discord password, and don't send the token in a DM. There are two better ways:

1. Keep the token to yourself. The developer builds and tests on their own application in a test server. At launch, you paste your production token into your host's settings, and they never need it. This is how I work: every build runs on your own Discord application, so you hold the token, and a Bot Rescue doesn't need your token either.
2. Add them to your team. Give them Developer if they need to change settings such as the interactions endpoint, or Read-only if they only need IDs. Remove them when the work is done, and reset the token if they ever saw it.

A developer who insists on logging in to your account is a red flag. The hiring guide lists others to watch for.

If your bot went offline after a reset or a leak and you'd rather have someone else get it running, Bot Rescue is a fixed $149 for one discord.js or discord.py bot, done within 3 business days with a short written report. If I can't fix it, you pay nothing.