How to Create a Telegram Bot with BotFather: Token & Setup (2026)
Building a Telegram bot starts with an identity, not code. Official @BotFather creates the bot and hands you an API token in a few minutes of chat commands.
Open official @BotFather, send /newbot, set a display name and a username ending in bot, and save the API token. Creation needs no programming; auto-replies need code that uses the token. Treat the token like a password.
Find real BotFather and run /newbot
- Search BotFather; pick the blue-verified @BotFather
- Start or send /start
- Send /newbot
- Choose a display name (editable later)
- Choose a username ending in bot (letters/digits/underscore; unique; permanent)
- Save the API token BotFather returns
Lookalikes like @Bot_Father exist to phish; real BotFather never asks for your login codes. Install from the download page if needed.
Token hygiene and common commands
Store the token in a password manager. Do not commit it to public repos, paste it in groups, or screenshot it. If leaked, /revoke (or /token) inside @BotFather for that bot and discard the old key.
| Command | Purpose |
|---|---|
| /newbot | Create bot + token |
| /mybots | Manage bots |
| /revoke or /token | Rotate the token |
| /setcommands | Command menu |
| Group Privacy | Whether the bot reads all group messages |
Optional setup—and when code actually starts
From /mybots you can set avatar, description, and commands. Group Privacy on means the bot mostly sees mentions/commands; turn it off only if you truly need full-group reads for keyword bots.
A token is an identity. Auto-reply needs a library (for example python-telegram-bot): init with the token → handlers → polling or webhook. This article stops at identity; open an editor only when you need behavior.
Account security pairing—and when to stop
Bots ride your account. Harden account security and two-step first. Fake “support bots” asking for codes: phishing guide.
| Stage | Do | Do not |
|---|---|---|
| Create | Only blue-check @BotFather | Send login codes to “support bots” |
| Store | Password manager | Public repos / group screenshots |
| Groups | Least admin rights | Disable Privacy without need |
| Leak | /revoke immediately | Keep the old token |
| Identity only for now | Stop after the token | Buy a mysterious “ready bot” |
FAQ
Do I need to know programming to create a Telegram bot?
No. Creating the bot itself is code-free: open the official @BotFather, send /newbot, set a name and a username, and you receive an API token — the bot now exists. You only need code (e.g. the python-telegram-bot library) when you want it to auto-reply or perform tasks using that token.
Is @BotFather official, and how do I verify it?
Yes, @BotFather is Telegram’s official bot-management tool, shown with a blue verified badge. Impostors register lookalike usernames to phish for codes or passwords. The real BotFather only creates and configures bots — it never asks for your account password or login code.
What happens if my bot token leaks?
The token is the bot’s key — anyone with it can fully control the bot and its messages. If you suspect a leak, open @BotFather, select the bot, and run /revoke (or /token) to generate a new token; the old one dies instantly. Never commit tokens to public repos or share them in screenshots.
Does the username have to end in bot, and can I change it later?
Yes — the username must end in bot (case-insensitive) and be globally unique. The display name can change; the username usually cannot after creation. Pick a brandable spelling before you create it, and avoid official/support-style words that look impersonating. If taken, try another suffix or underscore.
Can a bot log into my account or receive my login codes for me?
No, and you should not expect that. A bot is a separate identity that sends/receives with its token; it cannot receive your login codes, and Telegram will not let a bot manage personal account sign-in. Anyone asking you to “send the code to the bot/support” is phishing — follow the phishing guide.
How do I add my new bot to a group as an admin?
In the group, add members, search your bot username, promote it to admin, and enable only the permissions you need (delete messages, ban users, etc.). For keyword triggers that read every message, disable Group Privacy in BotFather. Keep permissions minimal — don’t casually grant full control.
BotFather says the username is taken — what now?
Usernames are globally unique and must end in bot. Try another suffix, underscore, or spelling; the display name can still be localized. Don’t buy a “ready-made bot account” — an unknown token source means someone else may still control it.
I pasted the token in a group by mistake — is deleting the message enough?
No. Anyone who saw or synced it may still have the token. Immediately /revoke in @BotFather, take the new token, and update your code/services. Tokens in public repos should be treated as leaked too.
Should I enable two-step verification before creating a bot?
Yes. The bot hangs off your Telegram account — if the account is taken over, bot control can go with it. Use the same habits as a normal account: 2FA, session checks, and only the blue-check @BotFather when creating.
Need the installer or platform notes?
The download page lists versions, requirements, and install entry points.
Open download page