Getting started
How to get a Telegram bot token, and how to keep it safe
By the Botable team
A Telegram bot token is the single credential that controls a bot. You get it from @BotFather with /newbot or /token, it looks like 123456789:AAH…, and anyone who has it can act as your bot completely. Treat it like a password.
Watch it
A token is not a setting on the bot, it is the bot, and whatever holds the string can act as it. Why Botable checks it on entry, and what to do the day it ends up somewhere public.
Read the transcript
Everything said in the video, in order.
A bot token is one line of text that Telegram hands you. It is not a setting on the bot — it is the bot. Whatever holds that string can act as it.
So it pays to know what the string is, why Botable checks it on entry, and what to do the day it ends up somewhere public.
I have a token is the tab for a bot that already exists, one you made in BotFather. The other tab has Telegram make the bot and hand the token over, so you never see it.
A project needs two things: what the bot should do, and the Telegram identity it runs as. The description is the easy half.
The token is the other half. Digits, a colon, then a long random tail. The digits are the bot's public Telegram ID; everything after the colon is the secret.
No password beside it, no account behind it. A token in a screenshot or a public repo is a working bot for whoever finds it — they read every message and answer in your name.
Botable does not take the string on trust. It asks Telegram whose bot this is, and once that clears the token is attached to a project like this one. The name in the corner came back with the answer.
So did the public link. Nobody typed Lumen Support or its t dot me address into Botable — one call with the token and Telegram returned the name, the username, and the link people use to find it.
That check is also why a token cannot be used twice. A token already registered is refused: one Telegram bot, one project, across the whole platform.
After that you never type it again. Botable signs everything with it — registering the bot, pulling the names in your audience, sending a broadcast.
Which is why, the day a token is revoked, every screen that talks to Telegram stops with it. This one is asking Telegram to describe a bot whose token no longer opens anything.
Not deleted, not broken — only no longer holding a key that works. And the fix is not in Botable: open BotFather, revoke the old string and ask for a new one. The old one dies the instant you do.
Paste the fresh token into the project and it is verified and registered exactly like the first. Your code, your database and the people already in your audience carry on untouched.
Treat it like a password, and rotate it the moment you doubt it. Start free at botable dot I O.
The short version
A Telegram bot token is a bearer credential: possession is authorisation, with no second factor and no per-action scope. It has two parts separated by a colon, a numeric bot id, which is public and appears in some API responses, and a secret string of about thirty-five characters, which is not. Anyone holding the full token can read every message your bot receives, send messages as it, change its profile, and point its webhook at a server they control, which quietly redirects your users' messages to them. There is no partial revocation and no read-only variant. The correct handling follows from that: the token lives in an environment variable or a secrets manager, never in source control, never in a screenshot, and never pasted to someone offering help. If it is exposed, /revoke in BotFather issues a new token and invalidates the old one immediately.
Step by step
How do you get a token for a new bot?
Message @BotFather, send /newbot, and answer the two prompts, display name, then a unique username ending in "bot". The token arrives in the confirmation message. It is shown once in that message but can be retrieved later, so losing the message is not losing the bot.
How do you retrieve the token for a bot you already have?
Send /mybots to BotFather, pick the bot, and choose API Token. Or send /token and select it from the list. Both display the current token; neither changes it, so retrieving is safe and does not invalidate anything already running.
Where should the token be stored?
In an environment variable or a secrets manager, read at startup. Not in the code, not in a config file that gets committed, not in a chat message. Add the file holding it to .gitignore before the first commit rather than after, git history is the most common place tokens leak from, and removing it from history is far harder than never adding it.
What do you do if the token leaks?
Revoke immediately: BotFather, /revoke, choose the bot. The old token stops working at once and a new one is issued, which you then update wherever the bot runs. Do this before investigating how it leaked, the investigation can happen after the exposure is closed, and every minute in between is a minute someone else can act as your bot.
What catches people out
- The token is a bearer credential: there is no read-only version and no way to scope it to one action
- GitHub and other scanners detect Telegram tokens in public repos, but not before someone else might
- Revoking breaks every running copy of the bot until each is updated, plan the swap, do not discover it
Questions
Can two programs use the same token at once?
Not reliably. Two pollers will fight over updates and each will see roughly half the messages, which looks like random unresponsiveness rather than a clear error. One token, one running instance, use a separate test bot for development.
Does the token expire?
No. It stays valid until you revoke it or delete the bot. That is convenient and is also why an old token in an abandoned repository is still live years later.
Want a bot that does this?
Describe it in plain language and Botable writes the code, gives the bot its own database, deploys it and keeps it running. Everything on this page is handled for you, the token, the webhook, the storage, the hosting.
Keep reading
- Create a Telegram bothow to create a telegram bot
- BotFather commandsbotfather commands
- Bot securitytelegram bot security