Use Telegram’s start parameter to carry a short, opaque lookup token—not permission to perform an action. In PHP, generate unpredictable token material, encode it to fit Telegram’s 64-character base64url limit, and map it to server-side state. When the bot receives /start, validate the token and its purpose, expiry, use status, and any required account binding before acting.
How Telegram start links work
A bot link can pass a parameter using either form:
https://t.me/<bot_username>?start=<parameter>tg://resolve?domain=<bot_username>&start=<parameter>
Telegram documents a maximum of 64 base64url characters for the start parameter. After a user opens the link and activates the Start button, the client invokes the bot-start operation with that parameter. The link is a way to deliver input to the bot; it does not establish that the sender is authorized to use the value. See Telegram’s deep-link documentation.
As an Amazon Associate I earn from qualifying purchases.
Telegram’s messages.startBot method calls the value start_param and documents errors for empty, invalid, or overly long parameters. Those checks validate the protocol input, not your application’s token, permissions, or workflow.
Generate a compact, unpredictable token in PHP
PHP’s random_bytes() generates cryptographically secure random bytes. Raw bytes are not necessarily suitable for a URL, so encode them using a URL-safe alphabet and check the final character count against Telegram’s limit. The PHP manual documents the function and its output considerations at random_bytes().
#1 Best Overall
<?php
// 24 random bytes become 32 unpadded base64url characters.
$raw = random_bytes(24);
$token = rtrim(strtr(base64_encode($raw), '+/', '-_'), '=');
if (strlen($token) > 64) {
throw new RuntimeException('Telegram start payload exceeds the documented limit.');
}
$botUsername = 'ExampleBot';
$link = 'https://t.me/' . $botUsername . '?start=' . rawurlencode($token);
// Store a protected representation of $token with its purpose,
// expiry, consumption status, and any required account binding.
The 24-byte choice above is an implementation example, not a Telegram requirement. It produces 32 base64url characters without padding. Choose the token size for your threat model and keep the encoded result within the protocol limit. Do not put readable personal data, broad bearer credentials, or serialized commands in the link. Treat the payload as an opaque key that locates a narrowly scoped server-side record.
Map the token to narrowly scoped server-side state
A token record might represent an invitation, campaign attribution, an onboarding context, or a pending workflow. Those are application-level uses, not features or guarantees provided by Telegram. Store only what the bot needs to decide whether the requested action is allowed.
Rank #2
- Purpose: identify exactly what the token permits, rather than accepting a caller-supplied command.
- Expiry: reject tokens past their intended validity period.
- Consumption state: record whether a single-use token has already been redeemed.
- Binding: if the operation is for a particular user or account, verify that relationship separately. Possession of a link alone does not prove identity.
- Storage: consider storing a hash or otherwise protected representation of the token, so a database disclosure does not automatically reveal redeemable link values.
These checks are application security decisions. Telegram specifies how the parameter is passed, not how long a token should last, which database to use, or what a token should authorize.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsValidate the payload before taking action
Parse /start and its optional payload as untrusted input. Apply an allowlist for the token’s expected syntax, look up the corresponding record, then check every relevant condition before performing the mapped action. A token that is well-formed can still be unknown, expired, for another purpose, already consumed, or bound to a different account.
- Recognize the command and optional value. Support both bare
/startand payload-bearing/startupdates; do not assume every start message contains a token. - Check syntax and length. Reject malformed values rather than normalizing arbitrary input into a token.
- Look up the server-side record. Use the token as a lookup key, not as an instruction or authorization decision.
- Check context. Verify the record’s purpose, expiry, consumption status, and any required user or account binding.
- Apply the action only after validation. For a single-use token, consume it atomically with the action or in a transaction so concurrent updates cannot redeem it twice.
- Respond safely on failure. Give a clear, harmless message for malformed, unknown, expired, or already-used values. Do not expose internal record IDs or secrets.
The specific webhook framework, database schema, router, and transaction mechanism depend on your application; Telegram’s cited guidance does not prescribe them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Handle first-time starts and unusable links
A user may open the bot directly rather than through a deep link, so make bare /start useful: explain what the bot does and what the user can do next. Telegram’s Bot Guidelines say, “Make sure that your bot supports the /start command — this is the first thing every user will send.”
Rank #4
For a failed payload, distinguish enough to help the user—such as asking them to request a fresh link—without revealing whether a sensitive account, invitation, or internal record exists. A token lifecycle is your application’s responsibility; Telegram’s start-link protocol does not define expiry or one-time-use behavior.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
