1 Sep 2026 · 10 min read
Create a Telegram bot and connect it to ConveRact
A five-minute BotFather path plus production webhook, security, AI testing, commands, product links, payments, and operational checks.
By ConveRact Channel Engineering
•
Reviewed for production implementation
WHAT YOU WILL LEARN
BotFather creation
Automatic secure webhook
Conversation and commerce testing
01
Create the bot with BotFather
Telegram bots are created through the official BotFather account. The resulting token authenticates the bot and must be treated like a password. Anyone holding it can control the bot until it is revoked.
Choose a clear display name and username owned by the client. Add a description, profile image, commands, and privacy information so customers understand which company operates the bot.
STEP BY STEP
- 1
Open the official @BotFather account in Telegram.
- 2
Send /newbot and follow the prompts for display name and unique username.
- 3
Copy the bot token and store it temporarily in a password manager.
- 4
Use /mybots to set the description, profile image, about text, and commands.
- 5
Do not send the token through chat, email, screenshots, or frontend code.
OFFICIAL LINKS
LAUNCH CHECK
Official BotFather used
Client-owned username chosen
Token stored securely
Bot profile completed
02
Make the ConveRact API publicly reachable
ConveRact uses Telegram webhooks rather than continuous polling. Set API_PUBLIC_URL to a stable public HTTPS origin. When the token is saved, ConveRact validates it with getMe and registers the tenant webhook through setWebhook using a secret token.
A temporary HTTPS tunnel is acceptable for development, but production needs a stable domain. Changing the public URL requires the Telegram connection to be registered again.
STEP BY STEP
- 1
Deploy the ConveRact API behind HTTPS.
- 2
Set API_PUBLIC_URL to the public API origin and restart the API.
- 3
Confirm the URL is accessible from the internet without authentication at the webhook path.
- 4
Keep reverse-proxy request bodies and the Telegram secret-token header intact.
OFFICIAL LINKS
LAUNCH CHECK
HTTPS certificate valid
Stable API domain configured
Proxy forwards headers
No localhost URL in production
03
Connect the Telegram bot in ConveRact
Telegram is available on the Business plan or above. Sign in to the intended workspace as Tenant Admin, open Channels, and create a live Telegram connection.
ConveRact encrypts the bot token, calls getMe to verify the bot identity, generates a webhook secret, and registers the webhook. Review the returned bot identity before continuing.
STEP BY STEP
- 1
Open ConveRact → Channels → Telegram bot → Connect.
- 2
Enter a recognizable connection name.
- 3
Paste the BotFather token into the encrypted token field.
- 4
Choose Live connection and save.
- 5
Open Connection details and run Test connection.
LAUNCH CHECK
Correct workspace selected
Correct bot identity returned
Connection test passes
Webhook status connected
04
Test the complete customer journey
A Telegram user generally needs to start the bot before it can message that user. Test from a separate customer account, not only the account that created the bot.
Exercise plain questions, multilingual messages, unavailable products, service enquiries, product links, quote creation, human handover, and payment links. Payment completion must be confirmed by the payment-provider webhook, never by a customer message saying that payment was made.
STEP BY STEP
- 1
Open the bot from a separate Telegram account and press Start or send /start.
- 2
Ask a question whose answer exists in the tenant catalog or knowledge base.
- 3
Confirm the conversation appears in ConveRact with channel Telegram.
- 4
Reply as staff and verify the customer receives it.
- 5
Test handover, a product or service link, and a test-mode payment link.
OFFICIAL LINKS
LAUNCH CHECK
Inbound message stored
AI response delivered
Staff reply delivered
Commerce and handover paths tested
05
Secure and monitor the bot
If the token is exposed, revoke it immediately through BotFather, update ConveRact, and test the new webhook. Do not log the raw token. Restrict administrative commands and never trust a Telegram username as verified customer identity for sensitive actions.
Monitor webhook failures, reply latency, delivery errors, duplicated updates, human handover, AI tool failures, and payment outcomes. Provide /help, a human-support command, privacy information, and a clear opt-out path.
LAUNCH CHECK
Token rotation documented
Sensitive actions require verification
Support path published
Health and failure events monitored
Put this guide into practice
ConveRact exposes setup steps, credential tests, connection health, role controls, and post-connect guidance inside the workspace.
Open workspace