Discord Bot Token: What It Is and How to Protect It

What the token is

When you create an application in the Discord Developer Portal and add a bot to it, the Bot page can show a token. It is a long string of letters, numbers and dots. Your bot's code sends it when it connects to Discord, and Discord uses it to decide which bot is calling.

The token is not the same as the application ID, which is public, or the client secret, which is a different secret used for sign-in flows.

What an exposed token allows

With the token, a stranger can run the bot from their own machine. They can send messages as it, read what it can see, and use every permission the bot has in every server it is in. A bot with Administrator or Ban Members in a big server is a serious risk in the wrong hands.

Discord does watch for leaks. If a token is posted in a public code repository, Discord detects it and resets it, then tells the owner. Do not rely on that, because a token shared in a private chat or screenshot is not caught.

Protecting a token

• Never paste it in a Discord channel, a support ticket, a screenshot or a public repository.
• Keep it in an environment variable or a secrets file that is not committed to version control.
• Give a bot only the permissions and intents it needs, so a leak does less harm.
• Reset it in the Developer Portal if you have any doubt. Resetting makes the old token stop working at once, and you then update your own setup with the new one.

No legitimate service needs your client secret. Only the bot token is ever needed, and only for hosting that runs your bot.

Tokens and Noxyr

The regular Noxyr bot needs no token from you. You only add it with the invite link. A token comes in when you set up a custom bot that runs Noxyr's features under your own bot name and avatar. For that you create your own Discord application and give Noxyr the bot token, with the Server Members and Message Content intents switched on. Noxyr never asks for the client secret, and you can switch the custom bot off or remove the token at any time, which returns your server to the normal Noxyr bot.

Giving a token to a host is a real trust decision, and the article on giving a bot token to a hosting service explains what to weigh. The full bot token guide covers resets in more detail.