How to get a Telegram bot token from BotFather

Every Telegram bot needs one secret string to work. Here's how to create your bot and grab its token in under a minute — no website, no sign-up form, just BotFather inside Telegram.

How to get a Telegram bot token, step by step

1. Open @BotFather. In any Telegram app, search for @BotFather and open the chat. Make sure it's the official one with the blue verified checkmark — BotFather is Telegram's own bot for managing bots.
2. Send /newbot. BotFather walks you through two quick prompts.
3. Pick a display name. This is what users see at the top of the chat — anything you like, e.g. My Cool Service.
4. Pick a username. It must be unique across Telegram and end in bot, e.g. mycoolservice_bot. This becomes your bot's t.me/… link.
5. Copy the token. BotFather replies with a line like Use this token to access the HTTP API: 123456789:AAH.... That long string is your bot token.

That's it — you now have a live bot. To point your code at it, you call the Bot API at https://api.telegram.org/bot<TOKEN>/METHOD. A quick sanity check is the getMe method:

https://api.telegram.org/bot123456789:AAH.../getMe

If it returns your bot's details, the token works. From there, see how to build a Telegram bot to wire up real commands and replies.

Keep your bot token secret

Anyone holding your token can fully control your bot — read messages it receives, send messages as it, and change its settings. Treat it exactly like a password:

• Never paste the token into client-side code, a public GitHub repo, a screenshot, or a support chat.
• Store it in an environment variable or a secrets manager, not hard-coded in source.
• If the token ever leaks, revoke it immediately (see below) — there's no harm in regenerating.

How to regenerate or revoke a bot token

If a token is compromised, you don't delete the bot — you rotate the token:

1. Open @BotFather and send /mybots (or /token to fetch, /revoke to rotate).
2. Pick the affected bot, then choose API Token → Revoke current token.
3. BotFather instantly invalidates the old token and gives you a new one. Update your deployment with the new value.

The old token stops working the moment you revoke it, so rotate first and update your config second to close the gap.

Bot token vs api_id / api_hash — what's the difference?

These two get mixed up all the time, so it's worth being precise about how to get an api_id on Telegram versus a bot token:

For the vast majority of projects you only need a bot token — the Bot API covers commands, messages, payments, inline buttons, and more, and every Bot API bot is fully within Telegram's Terms of Service. You only reach for api_id / api_hash when you're building a client that acts as a normal Telegram user rather than a bot.