Telegram Bot Token: How to Get It, Find It Again, Check It and Keep It Safe

Updated: October 29, 2026 · 6 min read

A Telegram bot token is the secret key that authorizes every Bot API request your bot makes. You get it from @BotFather when you create a bot with /newbot, view it again later under /mybots → API Token, check it with getMe, and revoke it in seconds if it leaks. Below are all four tasks with copy-paste commands, plus how to store the token safely and why automation tools ask for a token and a chat id.

What a Telegram bot token looks like (example)

A token has two parts separated by a colon: the bot's numeric id and a secret string. Telegram's documentation uses 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11 as an example; this guide uses the placeholder 123456789:AAEexampleTokenReplaceWithYours. In every request the token follows the literal word bot: https://api.telegram.org/bot<token>/METHOD_NAME.

Whoever holds the token has full control of the bot: they can read its incoming messages, send messages in its name, and change its webhook, commands and description. Don't confuse it with api_id and api_hash, which are credentials for apps built on the MTProto Telegram API, not for bots.

How to get a Telegram bot token

1. Open @BotFather and send /newbot.
2. Enter a display name, then a username: 5–32 characters, Latin letters, digits and underscores, ending in bot.
3. Copy the token from BotFather's reply.

The full walkthrough, from BotFather to a first message, is in how to create a Telegram bot. For experiments, create a separate test bot with its own token, so mistakes never reach the users of your production bot.

Find the token of an existing bot

1. Send /mybots to @BotFather.
2. Choose the bot from the list.
3. Press API Token. BotFather shows the bot's current token.

Don't use /token to look up a token: it generates a new one. Only the account that owns the bot sees it in /mybots. If a colleague created the bot, they can hand it over via /mybots → the bot → Transfer Ownership; the new owner must have interacted with the bot at least once.

Check a Telegram bot token with getMe

getMe needs no parameters, which makes it the standard token check:

curl "https://api.telegram.org/bot123456789:AAEexampleTokenReplaceWithYours/getMe"

A valid token returns "ok": true and the bot's User object, so you also see which bot the token belongs to:

{"ok": true, "result": {"id": 123456789, "is_bot": true, "first_name": "Weather Alerts", "username": "weather_alerts_bot"}}

An invalid token returns:

{"ok": false, "error_code": 401, "description": "Unauthorized"}

Typical causes of 401: a missing or extra character, a space, line break or quotes picked up while copying, or a token that has been revoked or regenerated. A 404 Not Found points to the URL itself, most often a missing bot before the token.

The same check in Python, handy as a startup test for your bot:

import os
import requests

token = os.environ["BOT_TOKEN"].strip()
data = requests.get(f"https://api.telegram.org/bot{token}/getMe", timeout=10).json()
if data["ok"]:
    print("Token OK for @" + data["result"]["username"])
else:
    print("Token rejected:", data["error_code"], data["description"])

Prefer a browser? Paste the token into getMe in the Bot API Tester and press Execute. The token is kept only in your browser's localStorage, and the request goes straight to api.telegram.org.

Revoke a leaked token

Treat the token as compromised if it was committed to a repository, shown in a screenshot or video, pasted into a chat, or shipped in front-end code. Deleting the commit or message is not enough, because someone may already have copied it. Revoke it:

1. Send /revoke to @BotFather and choose the bot, or open /mybots → your bot → API Token → Revoke.
2. Copy the new token. The old one stops working.
3. Replace it everywhere: server environment variables, CI secrets, n8n credentials, AI assistant configs. Then restart those services.
4. Run getMe with the new token, and getWebhookInfo to make sure the webhook still points to your server and not to a URL someone else set.

Keep your bot token secret

• Load the token from an environment variable or a secret manager; never hardcode it.
• Add .env to .gitignore before the first commit.
• Never put it in a Mini App, website JavaScript or a mobile app: anything shipped to users can be extracted. Call the Bot API from your backend.
• The token is part of every request URL, so don't log full request URLs, and mask the token in error reports.
• Use one bot per project or integration, so revoking one token doesn't break the rest.

# .env (listed in .gitignore)
BOT_TOKEN=123456789:AAEexampleTokenReplaceWithYours

import os

TOKEN = os.environ["BOT_TOKEN"]  # export it, or load .env with python-dotenv

// run with: node --env-file=.env bot.js  (Node.js 20.6+)
const TOKEN = process.env.BOT_TOKEN;

Telegram bot token and chat id for n8n and AI assistants

Automation platforms such as n8n and AI assistants that connect to Telegram, such as OpenClaw, usually ask for two values:

• Bot token: lets the tool act as your bot. Create a dedicated bot for each tool and check the token with getMe before pasting it.
• Chat id: tells the tool where to send messages or whose messages to accept. Message your bot, call getUpdates and read message.chat.id; how to get a Telegram chat id also covers groups, channels and topics.

Look up the chat id before you connect the tool. Once the tool receives updates for the bot itself, through a webhook or its own polling, your manual getUpdates calls conflict with it and fail with 409 Conflict. How webhooks work is explained in how to set up a Telegram bot webhook.

Troubleshooting token errors