Storing your bot token securely

The Bot Token is effectively the password of your Discord bot – anyone who has it can impersonate your bot. This guide shows you how to generate it and why storing it with Cordavix is secure.

Generating the token in the Discord Developer Portal

Open your application in the Discord Developer Portal (discord.com/developers/applications), switch to the "Bot" tab and click "Reset Token". Discord then shows you the new token exactly once – copy it to the clipboard immediately. If you already had a token before, resetting automatically invalidates it.

Entering the token in the dashboard

Paste the copied token into the corresponding field in the setup wizard under "Dashboard → Custom bots". The field is deliberately designed as a password field (masked input). After saving, Cordavix automatically performs a connection test.

How the token is stored

The token is stored in the database exclusively in AES-256-GCM encrypted form – with its own initialisation vector, a separately stored auth tag and key versioning, so that the encryption key can be rotated when needed without having to re-enter existing tokens. The token is decrypted solely by the instance manager in order to start your bot.

The token is never shown to you again after saving – neither in the dashboard nor via the API, neither in logs nor in a data export. The dashboard merely indicates whether a token is stored and when it was last changed.

Replacing or removing the token

Both are possible at any time in the bot area, but for security reasons they require you to confirm your credentials again (re-authentication). After a token change you additionally receive an email notification – that way you will notice if someone were to have access to your account without your consent. If you remove the token, the associated bot instance is stopped automatically.

One token, one account

A Bot Token can only ever be connected to exactly one Cordavix account. If you try to enter a token that is already connected, the dashboard reports this back to you in an understandable way; such an attempt is also recorded as a security event.

If your token has been compromised

Reset the token in the Discord Developer Portal immediately and enter the new token in the dashboard – a reset token instantly invalidates the old, possibly compromised one.