A Telegram bot token is the secret credential BotFather issues when you create a bot account, and it is what lets a program send messages as that bot instead of as a person. Autogram never asks you for a token: it runs its own bot, and you connect a channel by adding that bot as an administrator, so the credential stays on the Telegram side and there is nothing for you to paste or for Autogram to keep. The distinction matters if you also build a bot of your own. The token is the entire security boundary — whoever holds it can act as that bot, with every right you granted it — so it belongs in an environment variable or a secret manager, never in source control, a screenshot, or a chat message. Rotating it through BotFather invalidates the old one immediately.
You get a bot token by messaging @BotFather inside Telegram, choosing /newbot, and naming the bot. BotFather returns a long string in two parts — a numeric bot ID and a signing secret, separated by a colon — and that string is the token in its entirety. There is no separate password step; the token alone authenticates every request the bot account makes.
A token authenticates the bot to Telegram's servers, but it grants no rights inside a specific channel on its own. You must also add the bot as an administrator of the channel and grant it permission to post messages, the same way you would promote a human moderator. Autogram cannot publish to a channel where the bot has a valid token but no administrator role — the two checks are independent.
Anyone holding a bot's token can send messages, read updates, and change the bot's settings exactly as if they controlled it — Telegram has no way to tell the legitimate owner apart from a leaked-token holder. Revoking access means asking BotFather to generate a fresh token via /revoke, which immediately invalidates the old one everywhere it was in use — every server, script, and CI job holding a copy stops working until each is updated. That cost is the argument for holding as few copies as possible. It does not reach an Autogram channel: nothing there holds your token, so revoking your own bot leaves your scheduled posts untouched.
Automate your Telegram publishing with AI content, quality scoring, and smart scheduling.