Keep your Discord bot token private
Store tokens securely and rotate them immediately after accidental exposure.
Treat the token as a password
A Discord bot token grants access to the bot account. Anyone who obtains it may be able to act as your bot.
Keep it out of public chat, screenshots, logs, and source-code repositories. Load it from a private environment variable or the secret mechanism supported by your hosting panel.
If the token is exposed
Reset the bot token in the Discord Developer Portal for the correct application. This invalidates the old token.
Update the private token setting in your hosting environment and restart the bot. Check that it authenticates successfully with the new token.
Remove exposed copies
Remove the token from current source files and logs. A token removed from a Git file can still exist in repository history, so rotation is essential.
Review your bot's activity and application access if you suspect misuse.
Ask for help safely
Share the authentication error and relevant code with secret values replaced by placeholders. Support does not need your live token to diagnose a missing environment variable or incorrect startup command.
Need more help? Include your service name and what you have tried when you contact support.