How to secure discord bot token for a gateway connection in a public angular client?

I recently played a little bit with the Discord gateway, and now I want to open a gateway connection on my personal website to display my Spotify or game activity in real-time when I have opened my Discord client.

The development is all done and everything works great, but now I am wondering how I can secure my bot token, so nobody can grab it.

I host my website on Netlify; - I can use functions to fetch the token from env variables, but the token will be visible in the network tab.

I thought about encrypting the payload in functions or grabbing the request and adding the payload afterward in functions, but I don't think that is possible.

The bot in general only has permissions for the presence updates and message creation events in one channel, but I want to go a little bit more secure.

Maybe Oauth2, but I don't want that the user have to do extra clicks for just a little bit of information.

I hope someone of you has an additional idea - or is this just a bad idea?

Continue reading...