A Discord bot token is the password for a bot's account: whoever holds it can log that bot into Discord and make it do anything its permissions allow, in every server it has already joined. You get one free from the Discord Developer Portal when you create a bot application. Treat it like a password, because that is exactly what it is, not a public identifier like a bot's user ID or invite link.
How to get a Discord bot token
- Open the Developer Portal. Go to discord.com/developers/applications and sign in with the Discord account that should own the bot.
- Create an application. Press New Application, give it a name. This name is not the bot's display name yet, just the application's.
- Open the Bot tab. Discord adds a bot user to the application automatically. Set its username and avatar here; this is what members will see in the server.
- Turn on any intents you need. Under Privileged Gateway Intents, Server Members Intent and Message Content Intent are off by default. Most bots that welcome new members, read message text, or track roles need both turned on.
- Press Reset Token. Discord generates the token and shows it to you exactly once. Copy it immediately, there is no way to view the same token again later; pressing Reset Token a second time invalidates the first one and issues a new one.
- Paste it where it is needed. Into your own bot's code as an environment variable, or into a hosting provider's dashboard field, never into a chat message, a public repository, or a support ticket.
What a bot token actually grants
The token is how code authenticates as the bot user with Discord's gateway and REST API. With a valid token, code can:
- Log the bot in and keep it online
- Send and read messages in any channel the bot can see
- Take any action the bot's role permissions allow in each server it is already in: managing roles, kicking, banning, deleting channels, and so on
- Read the bot's own DMs and respond to interactions (slash commands, buttons, modals)
What it does not grant: the ability to add the bot to new servers. Inviting a bot requires a separate OAuth2 authorization link built from the application's client ID and a chosen permission set, which a server admin has to approve. A leaked token cannot be used to invite the bot anywhere new, but it can be used to cause real damage in every server the bot has already joined, up to whatever permissions that bot holds there.
Why you should never paste a bot token in chat
A bot token is a plaintext credential with no built-in expiry. Anyone who has it can run their own copy of your bot's identity until you reset the token, including in Discord support servers, GitHub issues, or screen shares where it is visible even briefly. Pasting one publicly, for example in a GitHub commit, is treated by Discord as a leaked credential and is a common way bots get hijacked to spam every server they are in. There is no way to tell after the fact who used a leaked token or what they did with it; the only fix is resetting it.
The same caution applies to sharing a token with a hosting provider. Only paste it into a provider's own dashboard field over HTTPS, never into a message to a person, however trustworthy, and never into a bug report.
Resetting a token revokes access instantly
Pressing Reset Token in the Developer Portal immediately invalidates the old token. Every process still using it, your own code, a hosting provider, anyone who obtained it without permission, gets disconnected on its next reconnect attempt and cannot log back in with the old value. This is the mechanism behind two things worth knowing:
- It is your kill switch. If you ever suspect a token leaked, reset it before doing anything else. The bot goes offline for whoever has the old token and comes back online only where the new token is entered.
- It is also how you change providers. Handed your token to a hosting service and want to leave? Reset the token in the Developer Portal and their access ends immediately, with no need to ask them to delete anything.
A bot disconnected by a reset token typically shows a gateway close code 4004 (invalid token) in its logs, which is Discord's way of saying the credential it tried to use no longer exists.
How Noxyr stores your token
Noxyr asks for a bot token only for its Custom Bot feature, where you run Noxyr's full feature set under your own bot's name and avatar. The token is stored encrypted, used only to log your bot into Discord's gateway, and never shown back to you or anyone else after you paste it. If you ever want to cut access, reset the token in the Developer Portal the same way described above; Noxyr's bot gets disconnected the moment you do, exactly like any other client using the old token. Full setup steps, the required intents, and the free Top.gg-vote access model are in the Custom Bot docs and our Custom Bot setup guide.
Common questions
Where do I find my Discord bot token? Developer Portal, your application, Bot tab, Reset Token. It is shown once at generation time; there is no page that displays an existing token again.
Is it safe to share a bot token? No. Sharing it, even privately, gives that person full control of the bot in every server it has joined. Only enter it into your own code or a hosting provider's dashboard field.
What happens if I reset my bot token? The old token stops working immediately everywhere it was in use. You get a new token to paste into your code or provider dashboard; the bot's identity, servers and existing data are unaffected.
Can a leaked token be used to add my bot to other servers? No. That requires the separate OAuth2 invite link and an admin's approval on the target server. A leaked token is still dangerous in every server the bot is already in.
Does resetting the token delete anything? No. It only invalidates the old credential. Settings, roles and stored data tied to the bot's application and user ID stay exactly as they were.
Setting up a bot of your own? Add Noxyr free, or see the hosting guide if you are writing your own code.