Open the Developer Portal and create an application. The application is the container for your bot user, OAuth2 settings, and credentials.

From the application's settings, note three values:

• Application ID — the public identifier of your app
• Public key — used to verify interaction signatures
• Bot token — the secret your app authenticates with

Treat the bot token like a password. Store it in an environment variable, never in source control. If it leaks, reset it in the portal.

export DISCORD_TOKEN=YOUR_BOT_TOKEN
export APP_ID=YOUR_APPLICATION_ID

Use the OAuth2 URL generator in the portal to build an install link. Select the applications.commands and bot scopes, then choose the permissions your app needs. Open the generated URL and pick your test server.

Request only the permissions your app uses. Server admins see this list before they approve the install, and a long list costs you installs.

Commands are registered against the API, not declared in your source. A global command is available everywhere your app is installed; a guild command appears in one server and updates instantly, which makes it the better choice while developing.

curl -X POST \
  "https://discord.com/api/v10/applications/$APP_ID/guilds/$GUILD_ID/commands" \
  -H "Authorization: Bot $DISCORD_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "hello", "type": 1, "description": "Say hello"}'

When someone runs /hello, Discord sends your app an interaction. Reply within three seconds with a callback type of 4 to post a message in the channel.

{
  "type": 4,
  "data": { "content": "Hello from my first app" }
}

Details of every callback type are in receiving and responding.

Start your app, open your test server, type / in the message box, and pick your command. Your reply appears in the channel.