Managing your Telegram bot token and secrets safely

A leaked bot token lets anyone send messages as your bot, read its data, and change its settings. Treat it like a password.

Use environment variables, not hardcoded strings

Read the token from an environment variable (os.environ["BOT_TOKEN"] in Python, process.env.BOT_TOKEN in Node.js) rather than typing it directly into a .py or .js file. This matters most if you ever push your code to a public GitHub repository — a hardcoded token in git history is effectively public forever, even if you delete it in a later commit.

If a token leaks

Message @BotFather, run /revoke (or /token to see the current one, then regenerate), and update the new token in your server's startup/environment configuration. The old token stops working immediately.

Separate bots for testing

Create a second bot via BotFather for development/testing rather than testing changes against your live, public-facing bot — this avoids sending broken messages to real users while you debug.

Trading and finance bots: extra care

If your bot handles trading signals, API keys for an exchange, or financial data, treat those exchange API keys with the same seriousness as the bot token itself — use read-only or trade-only exchange permissions (never enable withdrawal permissions on an API key your bot holds), and keep them in environment variables exactly like the bot token.

Related: Deploy a Telegram bot.