How to make a private Telegram bot accessible only by its owner?

Question

I'm developing a Telegram bot, which should be accessible only by its owner (only the owner would be able to add it to groups or see it in the search). Is it possible to achieve this via Telegram services (like BotFather) or should I check in my code if the one who's sending messages to the bot is the owner?

Selfimportant

Answer 1

You can do this in setting, you need to check by yourself, just exit program if .message.from.id not equal to yours.

You can disable join group via /setjoingroup, but you can't invite bot to group either.

Wymore

Wouldn't exit program will stop the bot from working also on my private channel or group? Shouldn't I just ignore a /start command from unrecognized source? – Hesperides

@Hesperides I didn't get you. :( – Wymore

Answer 2

There is nothing you can do with BotFather. the only way is to check it inside your code.

Simpatico

Answer 3

You can check for the chat id (9 digit number) in your code.

For example, if you use this wrapper to create bot, you can use update.message.chat_id to get chat id. You can also check for the first name (update.message.from_user.first_name) and last name (update.message.from_user.last_name).

Mycenaean

Answer 4

There's another option described in the telegram docs.

You can use a deeplink to get a unique key from the link and secure your bot. Denying access in your code to anyone who does not have the key.

From the docs:

1. Create a bot with a suitable username, e.g. @ExampleComBot
2. Set up a webhook for incoming messages
3. Generate a random string of a sufficient length, e.g. $memcache_key = "vCH1vGWJxfSeofSAs0K5PA"
4. Put the value 123 with the key $memcache_key into Memcache for 3600 seconds (one hour)
5. Show our user the button https://t.me/ExampleComBot?start=vCH1vGWJxfSeofSAs0K5PA
6. Configure the webhook processor to query Memcached with the parameter that is passed in incoming messages beginning with /start. If the key exists, record the chat_id passed to the webhook as telegram_chat_id for the user 123. Remove the key from Memcache.
7. Now when we want to send a notification to the user 123, check if they have the field telegram_chat_id. If yes, use the sendMessage method in the Bot API to send them a message in Telegram.

Hengelo

Re your just-deleted question: Look into top-level await. Webpack supports it. const go = await import(/*...*/); at the top level of your route module. – Philistine

Answer 5

I started working a few weeks ago on telegram's bots. For that I've read in the specifications there is no way to create a private bot from botfather. The only way is using a custom command like /password to send a password to the bot and then keep the chat id of the client (when password is correct of course ...). Your bot need to accept commands only from memorized/autentificated chat id as you would do it in a classical way for any other application.

Directional