How should I safely add Discord login to my website?

You probably do not need a bot token just to let someone sign in with Discord. Use Discord OAuth with the smallest scope you need, usually `identify` (and possibly `email` if you genuinely need the email address). The user authorizes your application, Discord returns an authorization code, and your backend exchanges that code using the client secret. The secret must stay on the backend because visitors can inspect every value in browser code.

That general flow is correct. The browser sends the user to Discord, Discord redirects back to a server-side Cloud Function, and the function handles the sensitive OAuth exchange and verification. A Cloud Function is basically backend code that runs when an HTTP request arrives, so it’s a reasonable option for a small project.

Keep the client secret and any tokens in the function’s environment or secret storage, never in frontend JavaScript. Once verification succeeds, the backend can create or update the user document in Firestore. The frontend should only receive a safe result or your own login session and then call your backend normally. Firebase Authentication plus Firestore is a perfectly reasonable place to start.

For the database part, avoid trusting the frontend to write important account fields directly. A user can alter browser requests, so anything involving identity, permissions, credits, or ownership should be checked and written by backend code. The frontend can send ordinary profile updates to an API, but the API should validate them and decide what gets stored.

A simple structure would be: browser starts OAuth, Discord redirects to your Cloud Function, the function exchanges the code and verifies the Discord account, then it creates or updates the Firestore user document and establishes a session. Later, the frontend uses that session to access your own API. Firebase Security Rules can provide another layer of protection, but they should not be treated as a replacement for keeping secrets off the client.