What a bot token is
A token is the string @BotFather gives you when you create a bot. In effect it is the bot’s password: any code that presents it to Telegram is treated as that bot.
So “is it safe to share a Telegram bot token” really means: are you comfortable with one more program acting as your bot. An ad network asks for it so that it can send the ad itself and confirm delivery.
Telegram bot token security: what a token allows
The caution is reasonable. Anyone holding the token can:
- Send messages as the bot to everyone who has started it — including a broadcast you never ordered.
- Receive incoming updates — what people write to the bot and which buttons they press.
- Change the bot’s settings: name, description, commands, webhook address. With the webhook pointed elsewhere, your own code stops receiving messages.
- Use the bot’s rights in chats: if the bot is an admin of a group or channel, those rights come with the token.
And here is what a token does not give:
- Access to your own Telegram account — your private chats, contacts or phone number.
- A way to message people who never started the bot. A bot cannot open a conversation first.
- The right to delete the bot or transfer it. That is done only in @BotFather from the owner’s account.
Bottom line: a token is access to the bot, not to you. The risk is real but limited and reversible: at worst, unwanted messages go out as your bot until you revoke the token.
How to reduce the risk
Rules worth following with any service:
- Never publish the token. Keep it out of chats and public code: tokens in public repositories are found automatically.
- Enter it only on HTTPS pages, on the service’s own site, not through a link from a message.
- Pick services that say how they store the token and what they use it for.
- Revoke it whenever in doubt, and when you stop using a service.
How to revoke a Telegram bot token
Open @BotFather, pick the bot, then API Token → Revoke current token. A new token is issued straight away and the old one stops working for everyone who had it. Paste the new one into your code and into the services you still use. Your users will not notice a thing.
How HiViews handles your token
In the standard setup you add the bot in the dashboard or in @HiViewsBot by its token, pass moderation and add one API call. The network then sends the ads.
- The token is stored encrypted.
- It is used for two things only: sending the ad post and checking that the viewer is a real user.
- You can revoke it at any moment in @BotFather (Revoke current token).
In return you are paid for every counted impression: $4.80 per 1,000 welcome impressions, $2.40 per 1,000 regular ones, and $0.04 per click on pay-per-click ads. The viewer check keeps ads away from fake accounts — see fake traffic in Telegram bots. Step-by-step setup is in the guide for bot owners.
How to monetize a Telegram bot without a token
If that does not settle it, or your project forbids handing the token to anyone, there is a second way: the token stays with you and the bot sends the ads itself.
-
Choose the no-token mode
When adding the bot in the dashboard, choose to connect without a token. You get a short code.
-
Prove the bot is yours
Put the code into the bot’s About text: @BotFather → Edit Bot → Edit About. Only the owner can change that text.
-
Get an API key
It is a key to the ad network, not to the bot: nobody can control the bot with it.
-
Add a function to your code
The bot requests a ready post —
POST https://hiviews.net/api/partner/ad— and sends it to the user itself. Ready functions for Python (aiogram), Node.js (Telegraf) and PHP are in the docs. -
Send the post as is
Do not change the text or links, and keep link previews on — the reason is below.
The bot itself decides when to ask for an ad (after /start or after delivering its result), requests the post and sends it as an ordinary message. The network sends nothing as your bot and has no access to it.
What is paid without a token
An impression is paid when the network is sure a specific person received the message. With a token it sends the post itself and sees Telegram’s response. Without one, the bot’s word is not enough: requesting an ad and sending it to nobody is trivial. So Telegram itself confirms the sending of every post.
A bot without a token gets every campaign of the network from the start — welcome and regular impressions, pay-per-impression and pay-per-click — plus external ads. There is no separate approval and no waiting. This is what is paid:
- Impressions — each impression whose sending Telegram confirmed. The rate per impression is lower than with a token.
- Pay-per-click ads — $0.04 per paid click.
- External ads — also paid per click; the price varies a lot by country and audience, and income is credited the next day.
How Telegram confirms the sending
The post text contains a hidden link. When the bot sends the message, Telegram itself fetches that link to build a preview, which tells the network the post really went out. An unconfirmed post is not paid: neither the impression nor the clicks on it.
Important: do not disable link previews for an ad post or strip links from its text. Without a preview Telegram does not fetch the hidden link, the sending is not confirmed, and that post is not paid.
What makes a bot lose paid impressions
Every link in the ad goes through HiViews tracking, and the network knows how often the same campaigns are clicked in bots with a token. A bot whose clicks do not match its impressions — far fewer or far more than expected — automatically loses paid impressions and goes back to pay-per-click only. A bot that does not really send most of the posts it takes stops getting ads.
The two modes compared
| Parameter | With a token | Without a token |
|---|---|---|
| What you share | The bot token from @BotFather | Nothing: a code in the bot’s About text, and you get an API key |
| Who sends the ad | HiViews | Your bot |
| What is paid | Every impression, plus clicks | Every confirmed impression, plus clicks |
| Rates | $4.80 per 1,000 welcome impressions, $2.40 per 1,000 regular, $0.04 per click | A lower rate per impression than with a token; $0.04 per click; plus external ads |
| Integration | One API call | Request the post and send it with your own code; ready functions in the docs |
| How to switch | Revoke the token in @BotFather | Paste the token on the bot page: no new moderation, no code changes |
Rates are in US dollars. The price of a click on external ads is not fixed.
An illustration, not a forecast. Say 10,000 welcome impressions are counted in a month: with a token that is 10,000 ÷ 1,000 × $4.80 = $48. Without one, the same impressions are paid too, provided Telegram confirmed the sending of each, but the rate per impression is lower, so the total comes out smaller. Clicks on pay-per-click ads cost the same in both modes: $0.04 per click. Real figures depend on your audience and the ads available — more in How much a Telegram bot earns.
Which one to choose
- No-token mode — if you are trying the network out, will not give the token to anyone, or want full control over what the bot sends.
- Token mode — if income matters: the rate per impression is higher, no sending confirmation is needed, and it takes a single API call.
- Start without a token, switch later — if you first want to see which ads arrive and how users react.
How to switch to the full mode
Paste the token on the bot’s page in the dashboard. No new moderation, same API key, no code changes: the same request keeps working, but now the network sends the ads and impressions are paid at the token rate.
Other ways to earn from a bot are covered in How to monetize a Telegram bot; withdrawals are in the finance guide.
FAQ
Is it safe to share a Telegram bot token with a third-party service?
It can be, if you trust the service and accept that it can act as your bot. Share the token only over HTTPS and only with services that explain how they store and use it. You can revoke it in @BotFather at any time.
What can someone do with a bot token?
Send messages as the bot to people who have started it, receive incoming messages and change the bot’s settings: name, description, commands, webhook address. A token gives no access to the owner’s personal account, private chats or phone number.
How do I revoke a Telegram bot token?
Open @BotFather, pick the bot, then API Token → Revoke current token. The old token stops working immediately; paste the new one into your bot’s code and into any services you still use.
Can I monetize a Telegram bot without sharing the token?
Yes. On HiViews you prove the bot is yours with a short code in its About text and get an API key; the bot then requests a ready post and sends it itself. This mode pays for impressions whose sending Telegram confirmed and for clicks. Setup is in the docs.
How much is paid with and without a token?
With a token: $4.80 per 1,000 welcome impressions, $2.40 per 1,000 regular impressions and $0.04 per click on pay-per-click ads. Without a token, impressions whose sending Telegram confirmed are paid at a lower rate than with a token, and so are clicks: $0.04 on pay-per-click ads, plus external ads, where the click price depends on country and audience.