Telegram Bots are ready now.
If we use the analogy of web browser and websites, the telegram client applications are like the browser clients.
The Telegram Chatrooms are like websites.
Suppose we have some information we only want to restrict to certain users, on the websites, we will have authentication.
How do we achieve the same effect on the Telegram Bots?
I was told that I can use deep linking. See description here
I will reproduce it below:
- Create a bot with a suitable username, e.g. @ExampleComBot
- Set up a webhook for incoming messages
- Generate a random string of a sufficient length, e.g. $memcache_key = "vCH1vGWJxfSeofSAs0K5PA"
- Put the value 123 with the key $memcache_key into Memcache for 3600 seconds (one hour)
- Show our user the button https://telegram.me/ExampleComBot?start=vCH1vGWJxfSeofSAs0K5PA
- Configure the webhook processor to query Memcached with the parameter that is passed in incoming messages beginning with /start. If the key exists, record the chat_id passed to the webhook as telegram_chat_id for the user 123. Remove the key from Memcache.
- Now when we want to send a notification to the user 123, check if they have the field telegram_chat_id. If yes, use the sendMessage method in the Bot API to send them a message in Telegram.
I know how to do step 1.
I want to understand the rest.
This is the image I have in mind when I try to decipher step 2.
So the various telegram clients communicate with the Telegram Server when talking to ExampleBot on their applications. The communication is two-way.
Step 2 suggests that the Telegram Server will update the ExampleBot Server via a webhook. A webhook is just a URL.
So far, am I correct?
What's the next step towards using this for authentication?
Update: I created a GitHub repository with a very simple PHP application to illustrate the concept explained below:
https://github.com/pevdh/telegram-auth-example
Whether you use a webhook or not is irrelevant. The "deep linking" explained:
Now when your bot receives another message, it can query message.chat.id in the database to check if the message is from this specific user. (And handle accordingly)
Some code (using pyTelegramBotAPI):
import telebot
import time
bot = telebot.TeleBot('TOKEN')
def extract_unique_code(text):
# Extracts the unique_code from the sent /start command.
return text.split()[1] if len(text.split()) > 1 else None
def in_storage(unique_code):
# Should check if a unique code exists in storage
return True
def get_username_from_storage(unique_code):
# Does a query to the storage, retrieving the associated username
# Should be replaced by a real database-lookup.
return "ABC" if in_storage(unique_code) else None
def save_chat_id(chat_id, username):
# Save the chat_id->username to storage
# Should be replaced by a real database query.
pass
@bot.message_handler(commands=['start'])
def send_welcome(message):
unique_code = extract_unique_code(message.text)
if unique_code: # if the '/start' command contains a unique_code
username = get_username_from_storage(unique_code)
if username: # if the username exists in our database
save_chat_id(message.chat.id, username)
reply = "Hello {0}, how are you?".format(username)
else:
reply = "I have no clue who you are..."
else:
reply = "Please visit me via a provided URL from the website."
bot.reply_to(message, reply)
bot.polling()
while True:
time.sleep(0)
Note: the unique_code will not be shown as '/start unique_code', only '/start', in the Telegram client, but your bot will still receive '/start unique_code'.