How to get a Telegram bot token, find it and keep it safe

TL;DR. A Telegram bot token comes from @BotFather: send /newbot, pick a name and a username ending in bot, and the token arrives — 110201543:AAHdq…. Lost it? /mybots → your bot → API Token. Leaked? Revoke it there and the old one stops working. Check any token with getMe — or in the free token checker, which also lists your bot’s chat IDs. And for the Bot API it is all you need: the api_id / api_hash from my.telegram.org are for apps that talk to Telegram through MTProto.

The token is the one thing every Telegram bot integration asks for, from a five-line script to an automation service to an AI agent. Getting it takes a minute; most of the trouble comes later — finding it again, telling it apart from other Telegram credentials, and what to do the day it ends up somewhere it shouldn’t.

Step by step: getting a token from BotFather

1. Open @BotFather — Telegram’s own bot for creating and managing bots — and press Start.
2. Send /newbot.
3. Send a display name. It shows in chats and contacts and can be changed later.
4. Send a username. It has to end in bot (tetris_bot, TetrisBot), be 5–32 characters of Latin letters, digits and underscores, and — unlike the name — it cannot be changed later. A quick way to see whether a name is free is the username checker.
5. BotFather replies with the token.

The token looks like 110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw: digits, a colon, then a long run of letters, digits, dashes and underscores. Every request to the Bot API carries it in the address, behind the word bot: https://api.telegram.org/bot<token>/getMe.

BotFather also has a Mini App that does all of this with buttons instead of commands — same result, same token.

Finding the token of a bot you already have

Send /mybots to @BotFather, pick the bot and open API Token. That is the only place Telegram shows it: not the bot’s profile, not its chat, not Telegram’s settings. If you created the bot long ago and don’t remember which account owns it, it is the account in whose BotFather chat the bot appears under /mybots.

Checking that a token works

The Bot API has a method made for exactly this: getMe, “a simple method for testing your bot’s authentication token”. It answers with the bot’s name, username and ID when the token is right. Two ways to call it:

• open https://api.telegram.org/bot<token>/getMe in a browser, with your token in place of <token>;
• paste the token into the bot token checker, which sends the same request straight from your browser to api.telegram.org and then reads the bot’s recent updates to list every chat with its chat ID.

What the answers mean:

Telegram answers	It means
the bot’s name, username and ID	the token works
Unauthorized (401)	the token is mistyped, or it was revoked and replaced in BotFather
Not Found (404)	the address holds no token at all — the colon or the word bot in front of it is missing

A leaked token: revoke it now

Anyone who has the token controls the bot: reads what is sent to it, writes as it, changes its settings. Telegram’s tutorial says to treat it like a password, and that it can be revoked at any time via @BotFather.

If a token was pasted into a public repository, a screenshot, a shared document or a chat you don’t trust, revoke it in @BotFather → /mybots → your bot → API Token. The bot gets a new token and the old one stops working — whatever ran on the old token is disconnected, including your own code, so put the new token where your bot runs straight after.

Where to keep it in the first place: Telegram’s tutorial suggests a settings file or environment variables rather than the code itself. Code gets shared, forked and pasted into questions; an environment variable on the server does not.

The token is not the API ID and hash

A common mix-up: my.telegram.org issues an api_id and api_hash under “API development tools”. They identify an application that talks to Telegram through the MTProto API — mostly custom clients that log in as a user account, and also MTProto bot libraries and a self-hosted Bot API server, which ask for them on top of the token. The ordinary Bot API at api.telegram.org — what most bot services and automations use — takes the token from BotFather and nothing else.

Do you need to copy the token at all?

Not always. Telegram lets one bot create and manage others — managed bots: an app sends you a link, Telegram shows a window with the new bot’s name and username, you confirm, and the app receives the bot’s token from Telegram itself. The token never reaches your clipboard, so there is nothing to paste or leak. AdminHub connects a channel’s bot this way — the guide to creating a bot for your channel shows both paths, and creating a bot without code covers what to run behind it.

What to do with the token next

Most integrations ask for two values: the token and a chat ID — where the bot should post. The chat ID guide covers every kind of chat; the token checker finds the IDs of the chats your bot already talks to.

---

Sources, checked October 2026: Telegram Bot API — Authorizing your bot (token format and request address), getMe; Bot features — BotFather (/newbot, username rules, generating a new token, the BotFather Mini App), Managed Bots; Bot tutorial — revoking a token, treating it like a password, keeping it out of the code; Obtaining api_id — what api_id and api_hash are for.