How to Get a Telegram Bot Token from BotFather (2026)

Open t.me/botfather — the exact link Telegram's own documentation points at. Follow the link instead of typing "BotFather" into Telegram search. Bot usernames are first-come-first-served, look-alike accounts exist, and an impostor's whole job is to be the account you paste a token at later. If you do search, the genuine account carries a verification badge — but following the documented link is the safer habit.

Telegram's tutorial defines the credential you are about to collect precisely: a token is "a string that authenticates your bot (not your account) on the bot API" (core.telegram.org/bots/tutorial). It is not tied to your phone number, and Telegram documents no expiry for it — the only documented way it stops working is you replacing it.

Where tokens legitimately come from. For a bot you create yourself, BotFather is the only issuer. No third-party "token generator" produces a string the Bot API will accept. Telegram documents one narrow exception — a manager bot flagged can_manage_bots can pull tokens for bots it created, via getManagedBotToken — which has nothing to do with setting up a support inbox.

Press Start to open the conversation. BotFather answers with its command list, and Telegram notes that BotFather itself is the authoritative reference for that list, because new commands are added without announcement.

Send /newbot to BotFather. It asks for two things in order — a display name, then a username — and issues the token once both are accepted.

Display name. What customers see in the chat header and in contact details ("Acme Support", "Northwind Assistant"). Telegram places no format rules on it, and you can change it later with /setname.

Username. Telegram's documented rules: 5–32 characters, not case sensitive, Latin letters, numbers and underscores only, and it must end in "bot" — tetris_bot and TetrisBot are both valid forms in Telegram's own examples. It also has to be unique across all of Telegram, so expect a few rejections before one sticks.

The username cannot be changed later. Telegram states this outright, and it is the only permanent decision in the whole flow — display name, description, photo and even the token are all editable afterwards. It becomes your bot's public t.me/ link, so pick something a customer would believe belongs to your company.

Once both fields are accepted, BotFather confirms the bot and sends the token in the same message.

Optional polish, with the limits Telegram documents:

• /setdescription — up to 512 characters, shown under "What can this bot do?" before a customer presses Start.
• /setabouttext — up to 120 characters, shown on the bot's profile and sent along whenever someone shares the bot.
• /setuserpic — profile picture.
• /setcommands — the command menu customers see when they type /.

All four are also reachable through the inline interface at /mybots, and none of them are required to get a token (Telegram Bot Features).

BotFather sends the token inside its confirmation message, labelled HTTP API token. Copy the whole string. It is the only credential the Bot API accepts — every request is addressed as https://api.telegram.org/bot<token>/METHOD_NAME, so a token that is short by one character fails every call outright rather than degrading.

The shape. Telegram's API reference documents the token as a numeric ID, a colon, then a secret, and publishes this placeholder for it: 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11 (Bot API, "Authorizing your bot"). Read against the two other examples Telegram publishes:

• Before the colon — digits only. Telegram's published examples run from 6 digits in the API reference to 10 in the current BotFather tutorial. The number climbs as more bots are registered, so a bot created today gets a longer ID than one from 2015.
• The colon — exactly one :, and it is part of the token. Dropping it is the single most common paste error.
• After the colon — the secret. Letters, digits and hyphens appear in Telegram's examples, all three of which are 34 characters long. Telegram publishes no guaranteed length, so treat the secret as opaque and never reconstruct it by hand.

Every string above is Telegram's own documentation placeholder, and this page prints no realistic-looking sample on purpose: anything in a help article that resembles a working credential is a credential somebody will eventually try.

Handling it after you copy it:

• Anyone holding the token can read every message sent to your bot and post as your bot. There is no second factor and no IP allowlist.
• Keep it out of screenshots, support tickets, issue trackers and chat history — including the chat you are copying it from.
• In code, read it from an environment variable or a secrets manager. A token in a committed .env is a public token.
• Pasting api.telegram.org/bot<token>/getMe into a browser is the quickest validity check, and Telegram's tutorial suggests it — but the address bar writes the token into history, autocomplete and any corporate proxy log. Prefer a terminal, and regenerate afterwards if the machine is not yours.

The current token is never lost. BotFather holds the active token and will display it on request, so "I lost my Telegram bot token" almost always means "I have not looked it up yet". What is genuinely unrecoverable is a token you have already replaced — Telegram keeps no history of superseded tokens.

To read the token you already have:

1. Open @BotFather
2. Send /mybots
3. Select the bot
4. Tap API Token — the active token is shown

Do not send /token when you only want to look. Telegram documents that command under the heading "Generating an authentication token": "If your existing token is compromised or you lost it for some reason, use the /token command to generate a new one" (Telegram Bot Features). It replaces the credential rather than reciting it. Sending it to jog your memory silently breaks every live integration still holding the old string, Converge included, until you paste the new value in.

To deliberately replace a leaked token, that same /token command is the documented route: send it, pick the affected bot, and the replacement arrives in the next reply. BotFather offers the same action as a Revoke current token button under /mybotsyour botAPI Token.

What a replacement changes, and what it does not:

• The old token stops authenticating at once. Anything still using it starts failing immediately, with no grace period.
• Username, display name, description, profile photo, command menu and past conversations are untouched. Customers see nothing at all.
• Telegram queues undelivered updates for at most 24 hours (Bot API, "Getting updates"). Messages that arrive while your integration is down survive inside that window and are gone after it, so reconnect the same day rather than the same week.

Replace the token when it reached a public repository, a screenshot, a shared document or a support ticket; when a contractor or departing colleague had a copy; or when you cannot account for where the copies live. Rotation is free and takes under a minute, which makes hesitation hard to justify.

BotFather's command list changes without announcement, and Telegram's documentation names BotFather itself as the authoritative reference for it — type / in the BotFather chat to see what your account currently supports.