Telegram token: get, manage, and secure your bot API key

Every Telegram bot runs on a single credential: its token. This 46-character string — formatted like 123456789:ABCdefGhIJKlmNoPQRsTUVwxYZ — authenticates every API call your bot makes. Lose it, and someone else controls your bot. Expose it in a public repo, and you'll find out within hours. According to Telegram's Bot API documentation (2025), over 10 million bots are active on the platform, each authenticated by a unique token issued through @BotFather. On CodeWords, you can build and deploy Telegram bots through conversation — Cody handles the token securely, so you focus on what the bot actually does.

Unlike generic AI automation posts, this guide shows real CodeWords workflows — not just theory.

TL;DR: - Get your Telegram token from @BotFather in under 60 seconds using the /newbot command - Never hardcode tokens — use environment variables or secrets management (CodeWords handles this natively) - Rotate tokens immediately via /revoke if compromised; build monitoring to detect unauthorized use

How do you get a Telegram bot token from BotFather?

The process takes less than a minute. Open Telegram, search for @BotFather (verified blue checkmark), and start a conversation.

Steps:

1. Send /newbot to BotFather
2. Choose a display name for your bot (e.g., "My Automation Bot")
3. Choose a username — must end in bot (e.g., my_automation_bot)
4. BotFather responds with your HTTP API token

That token is your single authentication credential. The Telegram Bot API uses it for every request: sending messages, receiving updates, managing webhooks. No OAuth flows, no client secrets, no refresh tokens — one string does everything.

Store it immediately in a secure location. Don't screenshot it, don't paste it in Slack, don't commit it to version control.

How should you store and manage Telegram tokens securely?

Token management follows the same principles as any API credential, but Telegram tokens carry extra risk: anyone with your token has full control of your bot's identity and message history.

Environment variables are the minimum viable approach. Set TELEGRAM_BOT_TOKEN in your deployment environment and reference it in code — never inline.

Secrets managers are better for production. AWS Secrets Manager, GCP Secret Manager, or HashiCorp Vault provide audit logs, rotation policies, and access controls.

On CodeWords, secrets are handled natively in the platform. When you tell Cody to build a Telegram bot, your token is stored encrypted and injected into the serverless runtime at execution time. It never appears in logs, generated code, or API responses.

A 2024 GitGuardian report found 12.8 million new secrets exposed in public GitHub repositories — API keys and bot tokens among the most common. Telegram tokens are particularly dangerous because exploitation is instant: no account creation needed, just start making API calls.

How do you revoke and rotate a compromised Telegram token?

If your token leaks — or you suspect it has — revoke immediately:

1. Open @BotFather
2. Send /revoke
3. Select the affected bot
4. BotFather issues a new token and invalidates the old one

The old token stops working instantly. Any service using it will fail. This means you need to update every deployment that references the token — which is why centralized secrets management matters.

On CodeWords, token rotation is a single conversation: "Rotate the Telegram token for my support bot." Cody updates the secret store and redeploys affected workflows automatically.

Build rotation into your operational cadence. Even without a known compromise, rotating tokens quarterly reduces blast radius. The OWASP API Security Top 10 (2023) lists broken authentication as the #1 API vulnerability — stale credentials are a primary vector.

What can you build with a Telegram bot token on CodeWords?

A token unlocks the full Telegram Bot API — messages, inline keyboards, file handling, payments, group management. On CodeWords, you combine this with 500+ integrations and LLM access to build sophisticated automations.

Notification bots: Monitor your infrastructure via CodeWords scheduling, send alerts to Telegram when thresholds trip. Connect to Slack, email, or PagerDuty in the same workflow.

AI chatbots: Build conversational bots powered by Claude, GPT, or Gemini. CodeWords' native LLM access means no separate API key management — just describe the bot's personality and capabilities.

Workflow triggers: Use Telegram messages as inputs to larger automations. "When someone sends a URL to the bot, scrape it with Firecrawl, summarize it with Claude, and post the summary back."

Group management: Automate moderation, welcome messages, or content scheduling for Telegram communities. The bot API supports all group admin actions programmatically.

According to Statista (2025), Telegram has 950 million monthly active users — building on this platform gives your automations massive distribution potential.

How do you set up webhooks vs. polling for your Telegram bot?

Two approaches to receiving messages: long polling and webhooks. The choice affects architecture, latency, and hosting requirements.

Long polling (getUpdates) — Your service repeatedly asks Telegram "any new messages?" Simple to develop locally, no public URL needed. Latency depends on poll interval.

Webhooks (setWebhook) — Telegram pushes updates to your HTTPS endpoint instantly. Lower latency, more efficient, but requires a publicly accessible URL with valid SSL.

On CodeWords, webhook-based bots deploy to *.codewords.run URLs automatically — HTTPS, publicly accessible, zero configuration. Tell Cody "set up a webhook for my Telegram bot" and the platform provisions the endpoint, registers it with Telegram, and routes incoming messages to your workflow logic.

The Telegram documentation recommends webhooks for production bots handling more than a few messages per minute. Polling works for development and low-traffic scenarios.

How do you manage multiple Telegram bots and tokens?

Production operations often involve several bots: one for notifications, one for customer support, one for internal tools. Each has its own token, its own webhook endpoint, and its own update stream.

Organize your tokens with clear naming: TELEGRAM_TOKEN_SUPPORT_BOT, TELEGRAM_TOKEN_ALERTS_BOT, TELEGRAM_TOKEN_INTERNAL_BOT. Map each to its purpose in documentation.

On CodeWords, each bot lives as a separate workflow. You can manage them independently or orchestrate across bots — "When the support bot receives a complaint, notify the alerts bot to ping the on-call channel." The state persistence layer tracks conversation context per bot, per user.

Use BotFather's /mybots command to list all your bots, check their status, and manage settings. Each bot can have its own description, profile photo, and command menu — configured entirely through BotFather or the Bot API's setMyCommands.

FAQs

What does a Telegram bot token look like? A Telegram token follows the format {bot_id}:{secret_string} — for example, 123456789:ABCdefGhIJKlmNoPQRsTUVwxYZ. The first segment is your bot's numeric ID; the second is the authentication secret.

Can someone hack my bot if they have the token? Yes. The token provides full access to your bot: reading messages, sending messages, managing webhooks, and accessing files. Treat it like a password with admin privileges.

How many Telegram bots can one account create? BotFather allows up to 20 bots per Telegram account. For larger operations, use multiple Telegram accounts or manage bots through an organization.

Does the Telegram bot token expire? No. Tokens remain valid indefinitely until explicitly revoked via BotFather's /revoke command. This makes proactive rotation essential for security hygiene.

Tokens are the foundation, automation is the goal

Getting a Telegram token takes 60 seconds. Building something meaningful with it — a bot that monitors, responds, orchestrates, and adapts — that's where the real value lies. The token is just the authentication handshake; the intelligence comes from what you connect it to.

The implication for builders: don't stop at "I have a bot that echoes messages." Connect it to AI models, data sources, and business logic. The teams shipping useful Telegram bots in 2026 aren't hand-coding polling loops — they're describing behavior and letting platforms handle the plumbing.

Build your first AI-powered Telegram bot on CodeWords — describe what it should do, and Cody handles the rest.