How to protect a Discord bot with System Locker

Before your bot can even think about serving commands, it must confirm it's authorized to run. This guide covers a small, practical setup for adding that check to a discord.js deployment.

Why use the Simple API for a bot?

A Discord bot usually runs as a central service that your users connect to, so it does not need a desktop-style session living on an untrusted machine. The Simple API is the right fit: make a direct account or license-key check from the server you control and keep the management credential separate from the customer-facing bot.

Create a system, generate a license key for it, and use that key only in the environment where the bot runs. Keep the Discord token and license key separate so each can be rotated without changing the other.

1. Configure the bot host

Use Node.js 18 or later so that fetch is available. Keep the Discord token and System Locker license key in environment variables. The system ID identifies your application and is not a secret; the license key and any management credential are.

DISCORD_TOKEN=your-discord-bot-token
SYSTEM_LOCKER_KEY=the-license-key-for-this-bot
SYSTEM_LOCKER_SYSTEM=your-system-id
SYSTEM_LOCKER_HWID=central-bot-production

The hwid value is still part of the Simple API request. For a central service, use a stable deployment value such as central-bot-production, or use 1 when you deliberately do not want this check to bind the key to a deployment.

2. Add a Simple API check

The Simple API returns a direct result for each request. Make the check before connecting to Discord and fail closed if the response is anything other than true. The endpoint name is part of the API route; the product-level choice is the Simple API, not a long-lived client session.

async function checkSimpleApi(fields) {
  const response = await fetch('https://systemlocker.net/auth/mikros', {
    method: 'POST',
    headers: { 'content-type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams(fields),
  });
  return (await response.text()).trim();
}

export async function checkLicense() {
  const key = process.env.SYSTEM_LOCKER_KEY;
  const system = process.env.SYSTEM_LOCKER_SYSTEM;
  const hwid = process.env.SYSTEM_LOCKER_HWID || '1';
  if (!key || !system) throw new Error('System Locker configuration is incomplete');

  const response = await checkSimpleApi({
    key, system, hwid,
    version: 'bypass',
  });
  if (response !== 'true') throw new Error(`System Locker authorization failed: ${response}`);
}

3. Authenticate before connecting to Discord

Only create or log in the discord.js client after the Simple API check succeeds. If the check fails, stop the process and let your process manager restart it after you fix the license or network problem.

import { Client, GatewayIntentBits } from 'discord.js';
import { checkLicense } from './system-locker.js';

await checkLicense();

const client = new Client({ intents: [GatewayIntentBits.Guilds] });
await client.login(process.env.DISCORD_TOKEN);

The bot's license key is not an API key: it grants this deployment access to your system. Keep the management API separate and server-side if you use it later for fulfillment or support tooling.

4. Review copied installations with Aegis

A stable deployment value lets you notice when a license is being used outside the service you intended to authorize. Review authentication logs for unexpected locations or repeated failures, and investigate before enforcing a response: a host migration, cloned image, or container restart can also change the signal.

If your bot runs on infrastructure you control, the Simple API is the right boundary. Do not put a management API credential in the bot's public-facing code or use a customer-machine hardware policy for a central service.

When your bot grows

The first deployment only needs the direct check shown above. If your bot grows, you can evaluate higher system and user limits, expanded logging, more variables, reseller tooling, and higher-tier Aegis IP Intelligence when you need more operational visibility.

Ready to try the Simple API on your bot?

Create a system and protect one real discord.js deployment before you build out your production workflow.

Lifetime access for $5 Read the Bedrock reference