Telegram bots for businesses: what they do and how to set one up

A Telegram bot for a business is an automated account that runs inside Telegram and is driven by your own software. It is usually set up for one of three jobs: announcing events the moment they happen — a new order, an enquiry, a system alert; letting staff pull reports and update records by command; and answering simple customer questions such as order status. Setting one up is quick. The care goes into keeping the bot’s token secret and limiting who can use it.

Below, drawing on Telegram’s official Bot API documentation, we explain what a bot can do, how it is set up and what we recommend watching on the security side.

What is a Telegram bot?

A Telegram bot is a special Telegram account that needs no phone number and is run by software. According to Telegram’s introduction to bots, bots show a “bot” label in chats instead of a last-seen status. When someone writes to the bot, the message reaches your server, and the software there decides the reply or the action.

One rule shapes how a bot can be used from the start: bots cannot start conversations with users. The user has to message the bot first or add it to a group. So a bot that will notify customers is designed with a “start” step — a link on the order confirmation page, for example, that takes the customer to the bot and passes along the order number.

What does a business use a Telegram bot for?

Businesses mostly use Telegram bots for notifications, as internal team tools and for customer service.

Use	Example	Who uses it?
Notification bot	New order, enquiry, payment, stock threshold, server alert	Managers or the relevant team
Team bot	Daily report by command, record lookup, approvals	Staff
Customer bot	Order status, appointment reminders, common questions	Customers
Channel broadcast	Announcements, offers, content	Followers

Notification bots pay off fastest. Instead of getting lost in an inbox, an event reaches a phone at once, and a button under the message lets someone act on it there and then.

An example from the studio: our own notification bot

We use a Telegram bot for our own work at the studio. When an enquiry comes in through our website form, the message reaches us immediately, and buttons beneath it mark the enquiry’s status. If an enquiry has not been answered within a set time, the bot sends a reminder. It also checks at regular intervals that the site is reachable and how long its security certificate has left. Every day at a set hour it sends a daily summary, and on the first day of the week a weekly one.

Two lessons from running it shaped most of the advice below. First, frequent, irregular notifications soon stop being read; sending only real events instantly and gathering everything else into one regular report works far better. Second, it is not enough for a message to inform. The reader should be able to take the next step with a single tap.

How do you set up a Telegram bot?

A Telegram bot is created through BotFather — Telegram’s own bot for making bots — connected to a server and given its commands. The steps:

1. Create the bot. In BotFather, the /newbot command sets the bot’s name and username. BotFather generates a token used to control the bot.
2. Put the token somewhere safe. The token lives on the server in a secret environment variable. It is never written into code, a shared document or a chat.
3. Choose how to receive updates. The Bot API offers two mutually exclusive ways: getUpdates, where your server asks Telegram at intervals, or a webhook, where Telegram sends every update to your address. Updates that are not collected are kept by Telegram for no longer than 24 hours.
4. Define the commands. Commands such as /status or /report, and buttons under messages, are agreed. According to Telegram’s bot features page, commands start with / and can be up to 32 characters long.
5. Set up permissions. Decide who may use the bot — covered in detail in the security section.
6. Connect it to your other systems. A bot earns its keep with data from your forms, orders, CRM or accounts. Those connections are usually made through APIs and webhooks; we explain how in what is an API integration?.
7. Test and go live. The bot is tried with a small group first, then opened up.

How do you keep a Telegram bot secure?

A Telegram bot’s security rests on keeping the token secret, answering only authorised people and verifying every incoming request. Because a bot is usually connected to company systems, taking over the bot means a door into those systems.

The bot token is a password

Telegram’s documentation states that the token lets anyone who has it control your bot. So:

• The token is kept only on the server, in a secret environment variable or a secrets vault.
• It never goes into a code repository, a screenshot, an email or a support ticket.
• If you suspect a leak, generate a new token with BotFather’s /token command; the old one stops working.
• Know who has seen the token, and keep that list short.

Verify the webhook

If you use a webhook, your server must check that each incoming request really comes from Telegram. When setting the webhook, the Bot API lets you pass a secret_token. Telegram then adds that value to every request in the X-Telegram-Bot-Api-Secret-Token header, and your server should reject any request without it. All requests to the Bot API are made over HTTPS.

Limit who can use the bot

By default, a Telegram bot is an account anyone can message once they find its username. Team and notification bots therefore keep an allow-list: the bot answers commands only from specific user or chat IDs and ignores everything else. Telegram’s documentation also advises that a bot should always verify the commands it receives, including whether the user is authorised to use them.

Think about permissions by role. Not everyone who can read a report should be able to delete a record, and only people with approval rights should see the approve button.

Know about privacy mode in groups

Bots added to groups run in privacy mode by default and see only messages meant for them: commands addressed to them and replies to their own messages. If the bot is made an admin, or privacy mode is switched off, it receives every message in the group. So make a bot an admin only if it genuinely needs to be, and give it the least access its job requires.

Keep personal data to a minimum

Put only what the job needs into notification messages. Telegram is a service whose data is processed on servers abroad. Before passing personal data such as customer names, phone numbers or health details through a bot, assess it under data protection law — GDPR in the UK and EU, or KVKK in Türkiye, which has its own rules on transferring data abroad — and update your privacy notices accordingly. Check the legal detail with your adviser.

Message limits and other constraints

Telegram limits how fast bots can send messages. According to Telegram’s bot FAQ:

• In a single chat, avoid sending more than one message per second.
• In a group, a bot cannot send more than 20 messages per minute.
• Without paid broadcasts, bulk sending is limited to about 30 messages per second.

If thousands of customers are to be notified at once, sending is queued within these limits. Bots in groups also cannot see other bots’ messages, so a design in which two bots talk to each other in a group will not work.

Telegram or WhatsApp?

The choice depends on which app your customers use and who the bot is for. For team and notification bots, Telegram is quick to set up and flexible. For customer conversations, the channel your customers already use comes first.

Criterion	Telegram bot	WhatsApp Business API
Set-up	Bot created through BotFather	Meta business account, verification and number process
First message	The user must start	Outside the service window, only approved template messages
Interface	Commands, buttons, mini apps that open inside Telegram	Messages, buttons and lists
Best suited to	Internal teams, notifications, communities and channels	Sales and support conversations with customers

WhatsApp’s rules are covered in WhatsApp Business API sales automation. For bots that will talk to customers, see customer service chatbots.

Frequently asked questions

Can a Telegram bot send the first message to a customer?

No. Under Telegram’s rules, bots cannot start conversations; the user has to message the bot first or add it to a group. That is why customer notifications are designed with a “start” step, such as a link on the order page.

What should I do if my bot token leaks?

Generate a new token straight away with BotFather’s /token command; the old one stops working. Then update the token on your server and find where the leak came from. Make sure the token never again ends up in a code repository or a shared document.

Does a Telegram bot read every message in a group?

Not by default. Bots in groups run in privacy mode and see only messages meant for them. If the bot is made an admin, or privacy mode is switched off, it receives everything, so grant that only when it is needed.

Can a Telegram bot take payments?

Yes. According to Telegram’s documentation, payments for digital goods and services are taken in Telegram Stars, whilst physical goods are paid for through third-party payment providers. The payment design should be planned around what is being sold.

If you would like a Telegram bot for your team or your customers, see our bot development page, our automation and integration service for connecting it to your other systems, or simply write to us. We reply within two working days.