Loading…
Telegram is the most permissive of the four channels — no approval, no template review, no messaging window — and the mistakes people make with it are the ones the permissiveness hides.
A Telegram bot is created by messaging @BotFather, which hands back a token — a string like 123456789:AAE… — and that token is the entire credential. There is no separate password, no OAuth grant to revoke, no session to expire. Whoever holds the token controls the bot: reads its messages, sends as it, and can change its name.
So it is a secret, not a setting. Paste it into the product once and nowhere else; do not put it in a screenshot, a support ticket or a shared document. If it does leak, BotFather can issue a new one — the old token stops working the moment it does, and the bot's username, history and group memberships are untouched. Reconnect with the new token and everything resumes.
A bot cannot open a conversation. A person has to message it first — in practice, by pressing the Start button that Telegram shows when they open the bot — and only from then on can the bot write to them. This is the whole of Telegram's consent model, and it is enforced by the API rather than by policy: a message to somebody who never started the bot is simply refused.
The practical consequence is that a Telegram audience is built one Start at a time. The way to make that happen is a link: t.me/yourbot opens the bot with the Start button ready, and a start parameter on the end of the link tells your automation which poster, ad or page the person came from. A QR code of that link does the same thing offline.
Add a bot to a group and, by default, it does not see the conversation. It receives commands addressed to it, replies to its own messages, and messages that mention it — and nothing else. This is privacy mode, it is on for every new bot, and it is the single most common reason a group automation appears to ignore everything.
It is switched off in BotFather, per bot. And there is a second step that catches people: a bot already in a group keeps the old setting until it is removed from the group and added again. Changing privacy mode and seeing no difference almost always means the bot was never re-added.
Leave it on unless the bot genuinely needs to read the whole group — a welcome message, a /rules command and link removal all work without it, because a welcome is triggered by a join event and a link check only needs the messages it is allowed to see once privacy mode is off. Reading everything is what moderation needs; it is not what a welcome needs.
A bot in a group can post without being an admin. It cannot delete anyone else's message, restrict or remove a member, or pin anything, unless it has been made an admin with those specific rights. So a welcome message works from the moment the bot joins, and anti-link moderation silently does nothing until somebody promotes the bot.
Grant only what the job needs. Deleting messages and restricting members are enough for moderation; a bot does not need the right to add admins or change the group's details, and the fewer rights it holds, the less a leaked token can do.
There is no 24-hour window on Telegram. A bot can message anyone who has started it, at any time, with no template and no approval — which is why a Telegram automation can do things a WhatsApp one cannot, and why copying a WhatsApp flow onto Telegram usually leaves capability unused.
What replaces the window is the block button and rate limits. A person who is messaged too often blocks the bot, and every send to them fails from then on. And Telegram limits how fast a bot may send, so a broadcast to thousands of people is paced by the API rather than fired in one burst — a broadcast that seems slow is usually one that is being sent correctly.
No. A person has to start the bot — usually by pressing Start — before it can send them anything. The API refuses messages to anyone who has not. A link to the bot, with a start parameter to record where they came from, is how you get people to that button.
Privacy mode, which is on by default. In that mode a bot receives only commands, replies to itself and mentions. Turn it off in BotFather for that bot, then remove the bot from the group and add it back — the old setting persists until it is re-added.
No. A bot can message anyone who has started it, whenever it likes, with no template approval. The limits that exist instead are the block button and Telegram's sending rate limits, which pace a large broadcast rather than refuse it.
Whoever has it controls the bot until it is replaced. Ask BotFather for a new token; the old one stops working immediately, and the bot's username, chats and group memberships are unaffected. Reconnect with the new token and carry on.