Bot token: why it must never be in the code

A bot’s token is its password. Anyone who holds it can log in as the bot and act in its name. The habit to keep: the token lives in the bot’s environment, never in the code, never in Git, never in a message.

• The token is a password: it does not go in the code, in Git or in a message.
• The code reads DISCORD_TOKEN from the environment and reports a missing value clearly.
• An exposed token is reset in the developer portal, and the old one stops working.

Why the token does not belong in the code

A token written in bot.py or index.js ends up in every copy of the project, in the Git history, in screenshots and in backups. A single leak in any of these places is enough to compromise the bot.

• A public Git repository exposes the token to everyone, even after the file is deleted: the history keeps it.
• If a token leaks, reset it at once in the Discord developer portal: the old one stops working.
• A token pasted into a support message or a Discord channel is exposed too: never copy it there.

Read the token from the environment

An environment variable is a value the system passes to the program at launch. The code reads it by name, and the token stays outside the project.

• Python: import os, then token = os.environ["DISCORD_TOKEN"] and bot.run(token).
• Node.js: client.login(process.env.DISCORD_TOKEN), with nothing else in the file.
• Locally, a .env file may contain DISCORD_TOKEN=votre_token, add it to .gitignore so it is never committed.

Check and react

Code that reads an empty variable should fail clearly, instead of trying to connect with an empty token. The error message then says what is missing.

• Python: if not token: raise SystemExit("DISCORD_TOKEN missing") before starting the client.
• Node.js: if (!process.env.DISCORD_TOKEN) throw new Error("DISCORD_TOKEN missing");
• Gateway close code 4004 or LoginFailure: the token is wrong or was reset. Check the variable, without copying it elsewhere.

Why ACLClouds keeps the token out of the repository

The token is entered in the bot’s space on the ACLClouds dashboard, not in the code. The field also refuses a token typed as a variable name.

• The token is entered in the bot dashboard, without being written into the project files.
• The field refuses a variable name such as DISCORD_TOKEN typed in place of the token, to avoid a copy error.
• SFTP access per bot on port 2222: the code is uploaded on its own, with no secret to place in it.