Telegram bot for business: use cases, cost and a safe PHP setup

When owners hear "Telegram bot" they often picture a consumer toy. In practice a bot is a very small piece of software that connects your systems to a chat app your team already has on their phones. It can tell you the moment a large order arrives, ask a manager to approve a refund with one tap, or answer common customer questions. We build these as part of our integration work, and this is how we think about it.

Where Telegram fits for a US business

Be realistic about your audience. In the United States, customers mostly use SMS, iMessage, WhatsApp, email and web chat, and teams use Slack or Microsoft Teams. Telegram has hundreds of millions of users, concentrated in Europe, Asia, the Middle East and Latin America. That gives it two clear roles:

• Internal operations. It is simple, fast on mobile and has a free, well-documented bot API. Many small teams use it for alerts and approvals because setup takes hours, not weeks.
• International customers and communities. If you sell to or support customers in markets where Telegram is the default, a bot meets them where they are. Product communities, announcement channels and support groups are common examples.

If your customers are mostly American consumers, start with web chat or SMS for them and keep Telegram for your team. The same automation logic works for both.

Use cases that pay back quickly

• Payment and revenue alerts: "New order, $1,240, customer X" in a team chat, plus failed payment and refund notices. Connect it to your payment webhooks, as covered in our Stripe webhooks guide.
• Error and uptime alerts: a message when a backup fails, a health check turns red or errors spike. See our backup and monitoring guide for what to watch.
• One-tap approvals: refund over a limit, discount request, content ready to publish. The manager taps Approve or Reject in the chat and your system acts on it.
• New lead notifications: a form submission arrives in the sales chat with the details and a button to claim it. Faster first contact usually improves conversion.
• Daily digest: a short morning summary of sales, signups, tickets and incidents.
• Support triage and FAQ: a bot answers common questions and passes the rest to a human. If you want AI answers from your own documents, read our AI chatbot guide for cost, ROI and safeguards.

What it costs

The Telegram Bot API does not charge per message for normal use. Real costs are:

• Development: a simple alert bot is a few hours of work, an approval workflow or support bot takes days, and a bot with AI and CRM integration takes longer.
• Hosting: a small server is enough. A bot is mostly idle.
• Third-party services: AI model usage, a CRM, an SMS provider for fallback. These depend on volume.
• Maintenance: monitoring, updates and changes to the Bot API. Small, but not zero.

To justify it, estimate the time saved: minutes per alert or approval multiplied by volume, plus the value of faster response. Many teams see the payback in the first month because the alternatives are checking dashboards by hand or losing slow replies.

Setting up: from BotFather to a working webhook

1. Create the bot. In Telegram, talk to BotFather, create a bot and copy the token. The token is a password: store it as a secret on your server, never in code or in Git.
2. Create a team chat or group, add the bot, and find the chat ID from the first update the bot receives.
3. Choose a mode. Long polling is easiest in development. For production use a webhook: Telegram calls your HTTPS URL for each update.
4. Register the webhook with a secret token so you can reject anyone else who finds the URL:

curl -sS "https://api.telegram.org/bot$TG_BOT_TOKEN/setWebhook" \
  -d "url=https://example.com/telegram-webhook.php" \
  -d "secret_token=$TG_WEBHOOK_SECRET" \
  -d 'allowed_updates=["message","callback_query"]' \
  -d "drop_pending_updates=true"

A small, safe PHP implementation

First a helper to call the API with a timeout and a retry when Telegram says "slow down" (HTTP 429):

<?php
function tg(string $method, array $params, int $tries = 3): array {
    $url = 'https://api.telegram.org/bot' . getenv('TG_BOT_TOKEN') . '/' . $method;
    for ($i = 1; $i <= $tries; $i++) {
        $ch = curl_init($url);
        curl_setopt_array($ch, [
            CURLOPT_POST           => true,
            CURLOPT_POSTFIELDS     => json_encode($params),
            CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT        => 10,
        ]);
        $raw  = curl_exec($ch);
        $code = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
        curl_close($ch);
        $res = is_string($raw) ? (json_decode($raw, true) ?: []) : [];
        if ($code === 429) { sleep((int)($res['parameters']['retry_after'] ?? 1)); continue; }
        if ($code >= 500 || $raw === false) { sleep($i); continue; }
        return $res;
    }
    return ['ok' => false];
}

Then an alert with approval buttons, for example when a refund above your limit is requested:

tg('sendMessage', [
    'chat_id'    => getenv('TG_OPS_CHAT_ID'),
    'parse_mode' => 'HTML',
    'text'       => 'Refund request <b>#' . $refundId . '</b>: $' . number_format($amount, 2) . "\nCustomer: " . htmlspecialchars($customerName),
    'reply_markup' => ['inline_keyboard' => [[
        ['text' => 'Approve', 'callback_data' => 'refund:ok:' . $refundId],
        ['text' => 'Reject',  'callback_data' => 'refund:no:' . $refundId],
    ]]],
]);

And the webhook receiver, which verifies the secret, ignores unknown chats, avoids processing the same update twice and answers quickly:

<?php
// telegram-webhook.php
if (!hash_equals((string)getenv('TG_WEBHOOK_SECRET'), $_SERVER['HTTP_X_TELEGRAM_BOT_API_SECRET_TOKEN'] ?? '')) {
    http_response_code(403); exit;
}

$update = json_decode(file_get_contents('php://input'), true);
if (!is_array($update) || !isset($update['update_id'])) { http_response_code(400); exit; }

// idempotency: Telegram may re-deliver an update
if (!claim_update((int)$update['update_id'])) { http_response_code(200); exit; }   // e.g. INSERT IGNORE into a table

$chatId  = $update['message']['chat']['id'] ?? $update['callback_query']['message']['chat']['id'] ?? null;
$allowed = array_map('intval', explode(',', (string)getenv('TG_ALLOWED_CHATS')));
if (!in_array((int)$chatId, $allowed, true)) { http_response_code(200); exit; }     // ignore strangers

if (isset($update['callback_query'])) {
    [$what, $decision, $id] = explode(':', $update['callback_query']['data']) + [null, null, null];
    if ($what === 'refund' && ctype_digit((string)$id)) {
        handle_refund_decision((int)$id, $decision === 'ok', $update['callback_query']['from']['id']);
        tg('answerCallbackQuery', ['callback_query_id' => $update['callback_query']['id'], 'text' => 'Recorded']);
    }
}
http_response_code(200);

Notice the principles: authenticate the sender, authorize the chat, validate the payload and make the handler idempotent. The same principles apply to payment webhooks. Check who pressed the button too, because anyone in a group can tap it unless you restrict who may approve.

Security and compliance rules

• Keep the token secret and rotate it through BotFather if it ever leaks.
• Do not send sensitive data in chats: passwords, API keys, card numbers or health data. Regular bot chats are not end-to-end encrypted in the way people assume, so treat them like email.
• Restrict by chat and by user. Approvals should only be accepted from named people.
• Get consent for customer messaging and give an easy way to stop. Follow privacy rules that apply to your customers, such as GDPR for users in Europe, and describe the bot in your privacy policy.
• Log actions: who approved what, and when.
• Review the controls in our PHP security checklist, since the bot is one more entry point into your systems.

Reliability: rate limits and retries

Telegram limits how fast a bot can send: roughly one message per second to a single chat, a lower rate in groups and about thirty messages per second overall for broadcasts. For anything larger than a team chat, put messages in a queue and send them at a controlled rate. Always handle the 429 response and its retry_after value, respond to webhooks within a second or two and do slow work in the background, and monitor delivery failures so you notice a broken bot as you would any other service.

A sensible rollout plan

1. Week 1: alert bot for payments and errors in an internal chat.
2. Week 2: add lead notifications and a daily digest.
3. Week 3-4: add approvals with buttons and an audit log.
4. Later: customer-facing support or AI answers where your audience uses Telegram, measured against response time and ticket volume.

How we can help

We design and build Telegram, web chat and messaging automations for companies, with the integrations behind them: payments, CRM, email and AI. Read about our integrations service or book a short call and tell us which process you want to automate first.