Hide bot token from public view and access

[Ferido07]

• Exposing bot token for public would allow easy hijack of the bot. In
  addition, assuming the best in everyone and we say no one will do
  malicious act, it would not allow for 2 developers to run the bot at the
  same time while developing.

[theShinigami]

I already revoked the API token, i accidentally pushed it. And what do you mean by '2 developers to run the bot at the same time', if you mean 2 developer running the bot in the same API token, the token is already revoked.

[Eyob-T]

Hey, although you removed the bot token from the file, the token is still visible from the history page. I think easiest thing to do is create a new bot to generate a new bot token and just read the token from another file (e.g token.js) and add the token.js file to .gitignoreI guess you can share the token with other trusted developers or make a private repository.

[Ferido07]

I already revoked the API token, i accidentally pushed it. And what do you mean by '2 developers to run the bot at the same time', if you mean 2 developer running the bot in the same API token, the token is already revoked.

@masterSal I meant running more than one instance of the bot with same token.
Its good that it is revoked that is the intention any developer who needs to run it should create his own token. No token should be included in the code.

[Ferido07]

Hey, although you removed the bot token from the file, the token is still visible from the history page.

@Eyob-T
Yes that's why git is there to track changes. Removing the token is not complete until you change the token using botfather.

I think easiest thing to do is create a new bot to generate a new bot token and just read the token from another file (e.g token.js) and add the token.js file to .gitignoreI guess you can share the token with other trusted developers or make a private repository.

Creating a bot to generate a bot token is too much work. In addition that is the job of botfather. We just have to make sure no token is included in the code. When any developer needs to run the bot he just has to create his own token and run an instance of the bot with the new token he created.

In order to add the token to environment variables we can use dotenv package. The only addition required is to add a .env file at the root directory that is not included in source control.

This just reminded me to add .env exception to .gitignore.