Skip to main content

Telegram inbound webhook (public)

POST 
/api/telegram/webhook/:channel

PUBLIC server-to-server endpoint Telegram calls with each update. NO session / Sanctum / tenant / CSRF — trust comes solely from the per-channel secret echoed in the X-Telegram-Bot-API-Secret-Token header, compared to the channel's stored secret. The tenant is resolved from the channel id (never the request). Always 200 { ok: true } for a verified request (so Telegram does not retry-storm), even when the update is ignored; an unverified request gets 403 and an unknown/inactive channel gets 404. Idempotent on the Telegram update_id.

Request​

Responses​

Acknowledged (verified request; the update may have been ignored).