Skip to content

Discord Bot Token

Service Name: Discord

Service Description: Discord is a VoIP and instant messaging social platform that allows users to communicate via voice calls, video calls, text messaging, and media files in private chats or as part of communities called "servers".

Service Address: https://discord.com/

Validation Type: API Auth

IP Allow list: Does not exist at the token level, but Discord offers IP whitelisting for verified bots.

Secret Access Scope: Grants programmatic access to Discord's API, allowing bots to interact with servers, channels, users, and messages based on the bot's permissions and the OAuth2 scopes granted.

Secret Revokement URL: https://discord.com/developers/applications

Secret Example: OTk4NzY1NDMyMTAxMjM0NTY3.G4BfTw.qwertyuiopasdfghjklzxcvbnm1234567890

Suspicious Activity Investigation Instructions:

  • Review the Discord Developer Portal for unusual activity on your bot.
  • Check the bot's audit logs for unauthorized commands or actions.
  • Monitor for unexpected server joins, message sends, or permission changes.
  • Review OAuth2 scopes and permissions that may have been modified.
  • Check for unusual API requests in Discord's Developer Portal analytics.

Mitigation Instructions:

  • Navigate to the Discord Developer Portal.

  • Select your bot application from the list.

  • Go to the "Bot" tab in the left sidebar.
  • Under the "Token" section, click "Reset Token" to invalidate the current token.
  • Generate a new token and update it in your application.
  • Review and adjust the bot's permissions to follow the Principle of Least Privilege.
  • Enable two-factor authentication for your Discord account.
  • Store the new token securely using environment variables or a secrets manager.