Discord bot
Prepare an application in the Discord Developer Portal and invite it to your server with only the permissions it needs. Enable only the intents required by your library and bot features. Hosting does not configure Discord application permissions. After launch, test a simple command.
Telegram bot
Get your token from the verified BotFather in Telegram. Long polling is practical for small bots and does not need a public HTTP endpoint. A webhook requires a working HTTPS address and correct application configuration; a node address is not automatically a public webhook for your process.
A token is a secret
Never include a token in a public repository, service name or screenshot. Use private configuration or your application environment. If it leaks, revoke it immediately with the provider and issue a new one. Deleting the message containing it is not enough.
Libraries and API limits
Install trusted packages, maintain a dependency file and respect platform limits. A 429 response from Discord or Telegram means your application is calling its API too frequently; slow down according to the response.