E2 · The Telegram bot
10 minCreate the bot in @BotFather with /newbot and save the token in the project's .env file.
Done when: you have the token, and it does not appear in any file besides .env (the search in the third block finds nothing).
Lesson 3 · 15 min
The gate: the Telegram bot, with one owner
Telegram is the simplest gate: you create the bot in two minutes and get a token. That token is the key to the gate. Whoever has the token controls the bot, and anyone can message a bot. That's why this lesson is half creation and half protection.
Start lesson
In this lesson, you will
- 1Create the bot with /newbot in @BotFather
- 2Why the token stays only in .env and out of Git
- 3How the channel talks to Telegram (long polling)
- 4Why the bot should accept messages only from its owner
Goal: create the bot with @BotFather, store the token only in .env, and set the assistant to respond only to you.
01From @BotFather to your bot
Click each block.
Click each block in the diagram to see what it does.
INTELECTO was designed for one user. A Jarvis with access to your machine is powerful, and that’s exactly why it deserves care.
02Create and protect it, step by step
Click each step.
1. Create the bot
On Telegram, search for @BotFather (the official one, with a verified badge) and send /newbot.
Choose the name shown in the conversation and the @username, which must end in bot. It will reply with the token.
Name
Use the name from your meu-jarvis.md. The @username can be the name + _bot.
2. Save the token
Paste the token on a line in the project folder’s .env, as you learned in step 1.
Check that .env is in .gitignore. Bots find exposed keys on GitHub quickly.
Step 1 rule
The token doesn’t appear in any file other than .env.
3. One owner
When you build it (lesson 4), ask the agent to have the bot reply only to your Telegram user and ignore everyone else.
In the vault (lesson 7), you’ll see why this matters even more when the assistant runs commands.
Request for the agent
The bot replies only to my Telegram user; messages from other people are ignored and logged.
4. If the token leaks
A token in a screenshot, group, or commit has leaked. Don’t delete it and hope for the best: generate a new one in @BotFather and replace it in .env.
The old token stops working, and whoever got it loses access.
In @BotFather
/mybots → choose the bot → API Token → generate a new one.
03The .env and the check
Replace the text between < > with your token. Never paste the token here in the course or in a chat.
.env (in the project folder)
TELEGRAM_BOT_TOKEN=<paste the token from @BotFather here>
Terminal · check that .env does not get pushed
grep -n ".env" .gitignore git status --short
Terminal · look for the token outside .env
grep -rn "<the first 6 characters of the token>" . --exclude=.env
Simulation: illustrative example
grep shows the .env line in .gitignore.
git status does not list .env.
The search for the start of the token finds nothing outside .env.
If git status shows ?? .env, the line is missing from .gitignore: add it before any commit.
If the search finds the token in another file, delete it there and generate a new token in @BotFather.
04Practice: the Telegram bot
Exercise E2 in sequence 2.
E2b · Write down the sole owner's request
5 minIn your meu-jarvis.md, add the rule: it only responds to me on Telegram.
Done when: the rule is written down and will go with the build request in lesson 4.
05Test what you learned
The explanation appears after your answer.
Question 1 of 3
Where can the bot token appear?competency
Correct
Whoever has the token controls the bot. It belongs only in .env, which is in .gitignore; anywhere else, treat it as leaked and replace it.Not this one
Whoever has the token controls the bot. It belongs only in .env, which is in .gitignore; anywhere else, treat it as leaked and replace it.Review: Create and protect it, step by stepQuestion 2 of 3
Why does the bot need a list of people who can talk to it?
Correct
A Telegram bot is public to anyone who finds its @. Without the list, a stranger can talk to your Jarvis and use its tools.Not this one
A Telegram bot is public to anyone who finds its @. Without the list, a stranger can talk to your Jarvis and use its tools.Review: From @BotFather to your botQuestion 3 of 3
Your token appeared in a screenshot you posted. What should you do?
Correct
Deleting the post does not undo the leak. Generating a new token invalidates the old one; anyone who copied it loses access.Not this one
Deleting the post does not undo the leak. Generating a new token invalidates the old one; anyone who copied it loses access.Review: Create and protect it, step by stepTest complete
You got {a} out of {n} right. Get them all right to mark the lesson as complete.Choose an option. The explanation appears after your attempt.