Secrets

Secrets are values like your bot token or an API key. They don’t belong in the project folder, because that folder ends up in git and on servers.

In the IDE

Open Secrets from the toolbar. Values are encrypted with your operating system’s keychain (Keychain on macOS, DPAPI on Windows, libsecret or KWallet on Linux) and stored per project. The IDE can save or delete a secret but never shows it again.

When you press Run, the IDE decrypts the secrets and hands them to the bot process as environment variables. The bot process doesn’t inherit the IDE’s environment, only a few basics like PATH and HOME.

Caution

On Linux without gnome-keyring or KWallet, Electron falls back to weak encryption. The Secrets window warns you when that happens.

On a server

The runtime reads secrets from environment variables. If the project folder contains a .env file it’s loaded automatically:

.env

DISCORD_TOKEN=your-token-here

.env is in the project’s .gitignore. Commit .env.example (names only) instead.

Plugins and secrets

A plugin can only read a secret it asks for in its permissions, like secrets:OPENAI_API_KEY. DISCORD_TOKEN is never given to plugins.