Bot .env files and token safety: keep your secrets private
Your bot token is like a password. Anyone who has it can control your bot, so it should never be written directly into code you share.
What is a .env file?
A .env file is a plain text file that holds settings as simple NAME=value lines, for example a line that starts with TOKEN= followed by your token. Your code reads these values at startup instead of containing them.
- Python: the python-dotenv package loads .env for you.
- Node.js: the dotenv package does the same, and newer Node versions have built-in support for loading env files (check your version).
Setting it up
- Create a file named exactly .env in your bot folder.
- Add one line per secret, with no spaces around the equals sign.
- Load it at the top of your code and read the value from the environment.
- Add .env to your .gitignore file so it is never committed.
On your hosting panel
Upload the .env file through the Files tab, next to your main bot file. Some panels also offer startup variables in a settings area, which is another option. Check what your panel provides, and keep one method so you do not get confused about which value is used.
Rules to follow
- Never post your token in Discord chats, screenshots or support tickets.
- Do not upload .env to public GitHub repositories.
- Give each bot its own token.
- Keep API keys and database passwords in the same file.
If your token leaks
- Reset it immediately in the Discord Developer Portal (or revoke it with BotFather for Telegram).
- Update your .env file with the new token.
- Restart the bot.
- Check your bot servers for strange activity.
Discord automatically scans some public places and may reset tokens it finds, but do not rely on that. Treat any exposed token as compromised.