Getting started

How to get a Telegram bot token, and how to keep it safe

By the Botable team

A Telegram bot token is the single credential that controls a bot. You get it from @BotFather with /newbot or /token, it looks like 123456789:AAH…, and anyone who has it can act as your bot completely. Treat it like a password.

The short version

A Telegram bot token is a bearer credential: possession is authorisation, with no second factor and no per-action scope. It has two parts separated by a colon — a numeric bot id, which is public and appears in some API responses, and a secret string of about thirty-five characters, which is not. Anyone holding the full token can read every message your bot receives, send messages as it, change its profile, and point its webhook at a server they control, which quietly redirects your users' messages to them. There is no partial revocation and no read-only variant. The correct handling follows from that: the token lives in an environment variable or a secrets manager, never in source control, never in a screenshot, and never pasted to someone offering help. If it is exposed, /revoke in BotFather issues a new token and invalidates the old one immediately.

Step by step

How do you get a token for a new bot?

Message @BotFather, send /newbot, and answer the two prompts — display name, then a unique username ending in "bot". The token arrives in the confirmation message. It is shown once in that message but can be retrieved later, so losing the message is not losing the bot.

How do you retrieve the token for a bot you already have?

Send /mybots to BotFather, pick the bot, and choose API Token. Or send /token and select it from the list. Both display the current token; neither changes it, so retrieving is safe and does not invalidate anything already running.

Where should the token be stored?

In an environment variable or a secrets manager, read at startup. Not in the code, not in a config file that gets committed, not in a chat message. Add the file holding it to .gitignore before the first commit rather than after — git history is the most common place tokens leak from, and removing it from history is far harder than never adding it.

What do you do if the token leaks?

Revoke immediately: BotFather, /revoke, choose the bot. The old token stops working at once and a new one is issued, which you then update wherever the bot runs. Do this before investigating how it leaked — the investigation can happen after the exposure is closed, and every minute in between is a minute someone else can act as your bot.

What catches people out

  • The token is a bearer credential: there is no read-only version and no way to scope it to one action
  • GitHub and other scanners detect Telegram tokens in public repos, but not before someone else might
  • Revoking breaks every running copy of the bot until each is updated — plan the swap, do not discover it

Questions

Can two programs use the same token at once?

Not reliably. Two pollers will fight over updates and each will see roughly half the messages, which looks like random unresponsiveness rather than a clear error. One token, one running instance — use a separate test bot for development.

Does the token expire?

No. It stays valid until you revoke it or delete the bot. That is convenient and is also why an old token in an abandoned repository is still live years later.

Want a bot that does this?

Describe it in plain language and Botable writes the code, gives the bot its own database, deploys it and keeps it running. Everything on this page is handled for you — the token, the webhook, the storage, the hosting.

Build a bot

Keep reading

Bots that use this

All twenty-five guides