Discord bot: application, token, intents and safe token storage

Every Discord bot needs an application in the Discord Developer Portal and a token it logs in with. We'll show you how to create the application, which intents to turn on, how to invite the bot to a server and how to store the token so it never leaks.

Creating the application#

1. Open the Discord Developer Portal (opens in a new window) and log in.

2. Click New Application.

3. Enter a name (for example MujBot), accept the terms and click Create.

   The General Information page opens. You can set an icon and a description here.

4. Copy the Application ID. It's also called the Client ID and you'll need it to register slash commands. It isn't secret.

Bot token#

The token is the bot's password. Anyone who has it can control the bot: send messages, delete channels and ban people on every server the bot is on.

1. In the application's left menu, click Bot.
2. In the Token section, click Reset Token and confirm. Discord may ask for your password or a two-factor authentication code.
3. Copy the token (Copy) and store it right away (see “Storing the token”).

The token is shown only once. If you lose it, generate a new one with Reset Token. That invalidates the old token.

Don't mix them up: the short Client Secret string on the OAuth2 page isn't the bot token. The token is longer and consists of three parts separated by dots.

Privileged Gateway Intents#

Intents tell Discord which events to send to the bot. Most are freely available, but three are privileged and you have to turn them on on the Bot page in the Privileged Gateway Intents section:

• Turn on only what the bot needs. An intent has to be enabled in the Developer Portal and requested in code (GatewayIntentBits in discord.js).
• If the code requests an intent that isn't enabled in the Developer Portal, Discord closes the connection and the bot reports Used disallowed intents.
• A bot on 100 or more servers has to go through app verification, and Discord has to approve its privileged intents. When more than 10,000 users can see the application, Discord requires an application and a review for continued use of privileged intents, which then has to be renewed every year.

Without Message Content Intent, the bot only sees the text of messages that mention it, of direct messages with it and of messages it sent itself.

Inviting the bot to a server#

1. In the application's left menu, click Installation.

2. In the Installation Contexts section, keep Guild Install checked (installing to a server). You only need User Install for commands that users add to their own account.

3. In the Install Link section, choose Discord Provided Link.

4. In the Default Install Settings section, under Guild Install, add applications.commands and bot to Scopes.

   • bot – adds the bot user to the server.
   • applications.commands – lets the bot create slash commands on the server.

5. After you add bot, Permissions appears. Pick only the permissions the bot needs (see the table below) and save the changes.

6. Copy the link from Install Link and open it in your browser.

7. Choose Add to server, select the server and confirm with Authorize.

   The bot appears in the server's member list (offline until you start it).

You can also create the link manually on the OAuth2 page in the OAuth2 URL Generator section: check bot and applications.commands, pick the permissions and copy the generated URL.

Storing the token#

The token belongs in a .env file, not in your code. Create .env directly on the server so you don't have to move the token anywhere:

1. In the customer area, open the bot and go to the Files tab, to the root folder /.

2. Click New file and name it .env (with a dot at the start, no extension).

3. Type this in the editor:

   DISCORD_TOKEN=<BOT_TOKEN>
   CLIENT_ID=<APPLICATION_ID>
   GUILD_ID=<SERVER_ID>

   • DISCORD_TOKEN – the bot token. Replace <BOT_TOKEN> with the token from the Developer Portal, without quotes and without spaces around =.
   • CLIENT_ID – the Application ID from the General Information page.
   • GUILD_ID – the ID of your Discord server (in Discord, turn on User Settings › Advanced › Developer Mode, then right-click the server name › Copy Server ID).

4. Save with Ctrl+S.

Loading .env in code#

Node.js doesn't load .env on its own; you have to tell it to. Since you can't change the startup command on our servers, load .env directly in your code. The most reliable way is the dotenv package (install it on your computer with npm install dotenv):

const path = require('node:path');
require('dotenv').config({ path: path.join(__dirname, '.env'), quiet: true });

const token = process.env.DISCORD_TOKEN;

• require('dotenv').config({ … }) – loads the variables from the file into process.env. It has to be at the very top, before any code that uses the token.
• path: path.join(__dirname, '.env') – looks for .env in the same folder as index.js, no matter where the bot is started from.
• quiet: true – doesn't print a message about loading the file at startup.
• process.env.DISCORD_TOKEN – the value from .env. It's always text (a string).

For ES modules ("type": "module" in package.json), use import 'dotenv/config'; on the first line.

Since Node.js 20.12, you can do without the package and use the built-in process.loadEnvFile() function:

process.loadEnvFile(require('node:path').join(__dirname, '.env'));

If the .env file doesn't exist, this function throws an error. To find out your Node.js version, see Node.js version. On your computer, you can also start the bot with node --env-file=.env index.js.

The .gitignore file#

If you keep your code in Git (GitHub, GitLab), create a .gitignore file in the project:

node_modules
.env

Git will then never upload .env or node_modules. If you've already pushed .env by mistake, deleting it isn't enough (it stays in the history). Reset the token right away.

Other secrets#

Other passwords and keys belong in .env too: the database password, API keys for other services, webhooks. The same rules apply:

• in code, use only process.env.NAME, never the value itself,
• never print them to the console (a member of a shared service can see the console too),
• if they leak, revoke them right away with the service that issued them.

Verification#

• After you start the bot, it goes online on Discord and the Console doesn't show An invalid token was provided.
• To check that the token loaded, print only its length, never the token itself: console.log('Token length:', process.env.DISCORD_TOKEN?.length);. If it prints undefined, .env didn't load.

Troubleshooting#

An invalid token was provided.#

The token is wrong, stopped working after Reset Token, or didn't load at all. Check the token length (see Verification), the variable name in .env and in your code (DISCORD_TOKEN), and that .env has no extra quotes or spaces. If you're not sure, generate a new token and add it again.

Used disallowed intents#

The code requests a privileged intent that isn't enabled in the Developer Portal. On the Bot page, under Privileged Gateway Intents, turn on the intent, or remove it from the code.

process.env.DISCORD_TOKEN is undefined#

• dotenv is loaded after the code that uses the token. Put require('dotenv').config(…) on the first lines.
• The file is actually named .env.txt (Windows hides file extensions). Rename it to .env on the server.
• .env is in a different folder than the main file. Use path.join(__dirname, '.env').

Private application cannot have a default authorization link#

You turned off Public Bot on the Bot page, but Discord Provided Link is set on the Installation page. A private bot can't have a default link. Either keep Public Bot on, or choose None in Install Link and create the link in OAuth2 URL Generator.

Bot requires a code grant#

Requires OAuth2 Code Grant is turned on on the Bot page. Unless you specifically need it, turn it off.

I can't see my server in the list when inviting the bot#

You don't have the Manage Server permission on that server. Ask the server owner, or invite the bot to your own server.

Further reading#

• Discord: Getting Started (application, token, installation) (opens in a new window)
• Discord: Gateway Intents (opens in a new window)
• discord.js Guide: Application Setup (opens in a new window)
• Node.js: --env-file and process.loadEnvFile (opens in a new window)