How to store your Discord bot token safely (.env and dotenv)

Never hardcode your bot token in your source code. Put it in a .env file that you never share or commit, and load it at startup with dotenv (Node.js), Bun's built-in loader, or python-dotenv (Python). If a token leaks, reset it in the Discord Developer Portal immediately.

Why it matters#

Anyone with your token can log in as your bot. They can delete channels, ban members, spam DMs, or get your bot flagged, in every server it's in. Tokens leak most often through:

• Code pushed to a public GitHub repository.
• Screenshots or pasted code in help channels.
• Sharing a project zip with a friend.

Create a .env file#

In your bot's root folder (on Schokr, the server root in the file manager), create a file called .env:

DISCORD_TOKEN=your-token-here
CLIENT_ID=123456789012345678

No quotes or spaces are needed around the =.

Load it in Node.js (discord.js)#

Install dotenv and load it as the very first line of your entry file:

npm install dotenv

require('dotenv').config();

client.login(process.env.DISCORD_TOKEN);

With ES modules, use import 'dotenv/config'; instead. Recent Node.js versions can also load the file without a package using node --env-file=.env index.js.

Load it in Bun#

Bun loads .env automatically. Just read process.env.DISCORD_TOKEN or Bun.env.DISCORD_TOKEN.

Load it in Python (discord.py)#

pip install python-dotenv

Add python-dotenv to requirements.txt, then:

import os
from dotenv import load_dotenv

load_dotenv()

bot.run(os.environ["DISCORD_TOKEN"])

Using os.environ["DISCORD_TOKEN"] (rather than os.getenv) fails loudly with a KeyError if the variable is missing, which is easier to debug than a vague login error.

Keep the .env file private#

• If you use git, add it to .gitignore before your first commit:

.env
node_modules/
.venv/

• Share a .env.example with placeholder values instead of the real file.
• On Schokr, anyone on your team with file access to the server can read .env. Only give the files permission to people you trust. Team roles let you control this.
• Don't post your .env or console output that prints the token when asking for help.

If your token leaks: reset it#

1. Open the Discord Developer Portal and select your application.
2. Go to the Bot page and click Reset Token.
3. Copy the new token.
4. Update .env on your Schokr server with the file manager.
5. Restart the server.

The old token stops working the moment you reset it. If the leak was in a git repository, also remove the token from the history or treat the repository as compromised; resetting the token is what actually protects you.

Discord automatically scans public GitHub repositories for bot tokens. If it finds yours, it resets the token and messages you. Your bot then fails with an invalid token error until you update it; see invalid token errors.

Other secrets#

Treat API keys, database passwords and webhook URLs the same way: keep them in .env, not in code.