# How bot tokens are stored

> The exact mechanics - what algorithm, where the key lives, who can decrypt, and what else gets the same treatment.

## Encryption at rest

Bot tokens are encrypted with industry-standard authenticated encryption before they’re written to storage. That choice does two useful things for a credential: tampered ciphertext fails to decrypt instead of returning garbage, and identical tokens look different at rest so an attacker who somehow saw the storage couldn’t tell which two accounts share a value.

## Who can read your token back

Nobody, by design. There’s no admin screen in TicketCord that shows you a token, and our staff can’t look one up either. If you ever need a new token, reset it in the Discord Developer Portal and paste the new value in - there’s no recovery path that involves anyone reading the old one.

At runtime, the bot needs the token to sign into Discord. That decryption happens server-side, only for the lifetime of the bot’s connection, and the plaintext is never logged or sent over the network in cleartext.

## What else gets the same protection

Anything that’s technically a credential - your bot tokens, Discord application secrets, webhook signing secrets, and per-user OAuth tokens we use to fetch your server list. Ordinary configuration, ticket transcripts, and knowledge-base content sit behind our infrastructure controls but aren’t encrypted under the credential key.

## Rotating your bot token

Reset the token in the Discord Developer Portal, then paste the new value in TicketCord - Discord ends the old session automatically and we pick up the new token on the next connection. Step-by-step in [Create your first bot](https://ticketcord.com/help/getting-started/create-bot).

## Machine-readable resources

- [Canonical HTML](https://ticketcord.com/help/security/tokens)
- [TicketCord llms.txt](https://ticketcord.com/llms.txt)
- [AI page index](https://ticketcord.com/api/ai/pages)