How bots work: BotFather, the token and getUpdates

Let's see what a bot actually is — then it becomes clear why anyone can build one, including someone who's «not a computer person».

A bot = a program + a Telegram «socket»

Every bot has two parts:

1. A bot account in Telegram — a name, an avatar, a handle like @your_bot. Two minutes to create, and by itself it can do nothing: it's a storefront and a «socket» the second part plugs into.
2. A program that receives users' messages through Telegram and sends replies. It can live anywhere: on your computer or on a server.

Telegram carries the messages between the user and your program — no app, no website, no interface to build. Buttons, chats, notifications — all already made and running on billions of phones. That's why bots are the easiest way into building products: you write only the «brain», Telegram provides the «body».

BotFather: where bots are born

Remember from the previous lesson: the bot platform opened in 2015 together with @BotFather. It's the official registrar bot: send it /newbot, pick a name (people see it) and a handle (must end in bot) — and it hands you a token: a long string like 7213…:AAH8…. BotFather is also where you later set up the bot's «face»: description, avatar, the command menu.

The token is the ignition key

The token ties your program to the bot account: the program presents it to Telegram and gains the right to speak as the bot. Whoever holds the token controls the bot. Two iron rules follow:

• Never show the token to anyone — not in chats, not on screenshots, not in code you post anywhere. Someone with your token can answer your clients as your bot — and you won't even notice right away.
• Leaked it — replace it. BotFather has /revoke: the old token dies instantly, a new one is issued. That takes a minute and is nothing to be ashamed of; hoping «nobody noticed» is.

How a bot learns it got a message: getUpdates

Here's a question almost nobody asks, and they should: does a user's message «fly» into your program by itself? Think for a second. Actually — no. Telegram stores everything written to your bot in a queue on its servers — picture a mailbox registered to your bot. And the program goes to ask for the mail itself: every couple of seconds it sends Telegram a getUpdates request — literally «hand over the updates» — and collects the accumulated messages. Reply, ask again, and so on in a loop. That's exactly why a bot goes silent when the program is off: letters pile up, but nobody comes for them.

This mechanic has a consequence that will save you hours: one mailbox, one key. Launch two copies of the program with the same token — say, on your laptop and somewhere else — and they'll start snatching letters out of each other's hands, and Telegram will respond with an error. Keep the mail picture in mind: in the lesson on server deployment it will explain beginners' most common breakage.

What's new for bots in 2026

The basics above haven't changed in ten years — but the «cosmetics» grow with every Bot API version: buttons got colors, chats got checklists, messages got a disappearing mode. Good news: our bot only needs the basics, and you can order the fancy details from ChatGPT later with a single sentence — once the basics work.

Do this now

Open @BotFather → /newbot → invent a name and a handle (ending in bot). Save the token in your notes — not in chats. In the next lesson we'll commission the program that brings this bot to life.

Try it in the sandbox

Lock in the token rule through a story — copy the prompt whole:

Act out a scene and then dissect it. The hero is Mitya, a beginner.
He created a bot via @BotFather, got the token 7213456789:AAH8xQ…
(made up) and, excited, sent a screenshot with the token to a chat
of 200 friends. Show step by step: what anyone in that chat can do
with the token; what Mitya will see (and not see) from his side;
which BotFather command saves his bot. Finish with a one-sentence
rule for storing tokens.

Then check how well you understood the mail mechanic:

Using a mailbox metaphor, explain how a Telegram bot's program
receives messages via the getUpdates request: Telegram puts letters
into a box, the program comes to collect them itself. Then test me:
ask 3 comprehension questions (including what happens if two
programs fetch mail with the same key) and review my answers.