Telegram Bot Privacy: How to achieve that your bot will only receive messages that mention the bot by username

Question

To How to receive messages in group chats using telegram bot api, I find 2 solutions:

• Make the bot admin of the group
• Disable privacy

Unfortunately, if I do any of those, the Telegram bot will receive ALL messages sent to the group (according to my tests).

However, according with what I read, it should be possible to send to the bot messages only if I mention the bot eg @my-bot-name-bot

How to restrict the bot to receive messages only if I mention it?

Some screenshots:

Inseminate

I also reported it as as security "bug" here: bugs.telegram.org/c/39654 – Inseminate

Answer 1

Short answer

Keep privacy enabled, add the bot as member to the group (no admin). Follow the following structure:

• /heymyfriend@name-the-bot testing message

Long answer

Actually the reply was in the other post I mentioned, but I didn't understand it well. So I'm going to explain again with my words trying to help to whoever comes next trying to find a more privacy-happy solution.

It is possible to restrict the bot to receive messages only if we mention it.

Firstly, remember:

• Create your own bot (eg pabbly.com) or use the one provided by the service (eg IFTTT). Depending of the service you choose it's one way or the other. I didn't have any problem doing this step. It was easy following the given steps.
• Enable privacy in both father (it's enabled by default). Refer the previous post if you don't know how to do it.
• Add the bot to whatever group you need the bot to work (do NOT give admin rights).

Then, you just have to m̶e̶n̶t̶i̶o̶n̶ write a message following the following structure:

• /command-or-any-text@name-the-bot whatever text or link you want to share

The following worked in my tests:

• ✅ /heymyfriend@name-the-bot testing message
• ✅ /https://edinventa.com/@name-the-bot testing with URL (and more slashes)

The following didn't work in my test (do NOT include a space before the @):

• ❌ /hey my friend@name-the-bot testing message
• ❌ /heymyfriend @name-the-bot testing message

Inseminate

Answer 2

As you already know, if your bot is admin of the chat all messages are received to the bot. There's no way to alter this behavior.

The best way to only listen to messages that mentions bot by its username, you may edit your code and explicitly look if the message contains bot's username.

Here's a simple JavaScript example:

// (Change the bot username)
const username = "@my_cool_bot";

bot.on("message", async (ctx) => {
    // Ignore the messages that doesn't mention the bot. 
    if (!ctx.message.text?.includes(username)) return;

    // Process the message here...
})

Hope this helps :)

Overlying

hmmm maybe I'm asking in the wrong place and stackoverflow is not the place. Anyway: the bot still will receive all the messages, so still the privacy issue is there... – Inseminate

In that perspective, you shouldn't make the bot an admin... The bot being an admin of the chat literally means, they can manage the whole chat. So, it isn't really an issue... – Overlying

exactly. But apparently there is not any other way: either you make the bot admin, or you disable privacy. Mentioning the bot with @ as Telegram says doesn't seem to work at all!! – Inseminate