Your bot token is the password to your bot, so this guide explains how to keep it secret by storing it in your panel's Startup variables, never in your code, and what to do the moment it leaks.
Why the token matters so much
Your bot token is not just a setting; it is full control of your bot. Anyone who has it can log in as your bot, read what it can read, and send messages, kicks or bans in your name. Discord treats a token like a password, and for good reason. Protecting it is the single most important security step for any bot owner.
Rule one: never put the token in your code
Hard-coding your token, like client.login("MTk4N..."), is the most common way people leak it. The moment that file is shared, pasted into a chat, or pushed to GitHub, the token is out. Discord even scans public GitHub repositories and will automatically invalidate a token it finds exposed, which instantly knocks your bot offline.
Rule two: use the Startup variables
On GuavaHost, the safe home for your token is the Startup tab. Paste it into the token variable there. The panel passes it to your bot as an environment variable at runtime, so your code can read it without the value ever living in a file.
- Node.js (discord.js): client.login(process.env.DISCORDTOKEN);`
- Python (discord.py): bot.run(os.environ["DISCORDTOKEN"])`
Your code now says "get the token from the environment," and the actual secret sits safely in the panel.
If you prefer a .env file
Some projects use a .env file with a library like dotenv (Node) or python-dotenv (Python). An env file is a plain text file that holds your secrets. That approach is fine, with two conditions:
- Add .env to your .gitignore so it never gets committed.
- Never share or upload it anywhere public.
Between the two options, the Startup variable is the simpler and safer default because there is no extra file to leak.
Keep it out of everywhere else
- Do not paste your token into Discord, screenshots, or a support ticket. GuavaHost staff never need your bot token to help you.
- Do not commit config.json files that contain the token. If you must have a config file, keep secrets out of it.
- Do not send it to "verify your bot" bots or websites. Those are scams.
If your token has leaked
Act fast, because a leaked token is an open door:
- Go to the Discord Developer Portal, open your application, and under Bot click Reset Token. This immediately invalidates the old one.
- Copy the new token.
- Paste it into the token variable on the Startup tab.
- Press Restart. Your bot logs back in with the fresh token, and the leaked one is now useless.
Because resetting the token invalidates the old value everywhere, regenerating is always the right move if you are even unsure whether it leaked.
A quick safety checklist
- Token is in the Startup tab, not in your code.
- No token in any file you upload to GitHub.
- .env is git-ignored if you use one.
- You know how to reset the token if needed.
Do these four things and your bot is far harder to hijack than most.
Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.