Protecting Your API Tokens

Your API tokens and bot credentials are the keys to your Discord and Discordium integrations. Keeping them safe prevents unauthorized access, data theft, and abuse of your bots or account.

What Are API Tokens?

API tokens act like digital keys that allow apps or bots to connect securely to Discord and Discordium services. They prove that the request comes from you.

Discord Bot Token

Used by bots to log in and access Discord's API.

Discordium API Key

Used to access or manage public listings and premium features.

OAuth Tokens

Temporary access tokens for user authentication.

Why Protecting Tokens Matters

If someone gains access to your token, they can:

  • Take control of your bot or account
  • Read or modify server data
  • Impersonate your service
  • Spam or violate Discord's Terms of Service, resulting in suspension or bans
Never share your token publicly: not in messages, GitHub repos, screenshots, or code snippets.

How To Keep Tokens Secure

1. Never Hardcode Tokens

Store your tokens in:

  • Environment variables (.env)
  • Secret managers (e.g. GitHub Secrets, Railway, or Docker Secrets)
  • Private config files ignored by version control
DISCORD_TOKEN=your_secret_token_here

2. Use Limited Permissions

Only request the scopes or permissions your bot or API integration truly needs. Avoid ADMINISTRATOR unless absolutely necessary.

3. Rotate Tokens Regularly

If you suspect exposure or no longer use a service, revoke and regenerate your tokens in the Discord Developer Portal or Discordium Dashboard and update your environment configuration immediately.

4. Use HTTPS & OAuth Securely

Always call APIs over HTTPS, never plain HTTP. Never expose OAuth redirect URLs publicly or store tokens in browser local storage.

How Discordium Protects Your API Data

  • Encryption in transit & at rest via TLS 1.3
  • Rate limiting & WAF protection to prevent brute-force attacks
  • Token anonymization in system logs (no plain-text storage)
  • Automatic session invalidation after logout or regeneration
  • Audit logging for API access and developer dashboard actions

Discordium never stores your full Discord bot tokens, only minimal hashed identifiers when needed for service authentication.

Developer Best Practices

  • Don't share bot ownership with untrusted users
  • Monitor your bot's activity and audit logs
  • Use bot verification for public bots to prevent abuse
  • Keep dependencies updated (especially discord.js, nextcord, hikari, etc.)
  • Enable 2FA on your Discord developer account and Discordium profile

What To Do If a Token Is Compromised

  1. Immediately regenerate your token in the Discord Developer Portal or Discordium Dashboard.
  2. Remove or disable any suspicious integrations or webhooks.
  3. Notify your team and check your bot's permissions.
  4. If abuse occurred, report the incident to Discord Trust & Safety or support@discordium.org.

Treat tokens like passwords: private, encrypted, and never shared.

Last updated: November 2025 · Discordium.org

Protecting Your API Tokens | Safety | Discordium