Quick answer: A bot that receives customer questions and relays staff replies can usually use Bot API. An authorized user-account integration needs
api_id,api_hashand a user session. Business bot connections require the permissions granted for that connection.
Before choosing credentials, decide which identity customers will actually be talking to.
Compare three routes
| Route | Customer-facing identity | Main requirements |
|---|---|---|
| Standard support bot | Bot name and avatar | Bot Token and an established interaction |
| User-account support | Authorized user or business account | Application credentials and a user session |
| Business-connected bot | Connected business account | Bot Token, valid connection and granted rights |
Business features such as quick replies, greetings and opening hours have their own conditions. Current official documentation also makes connected bots available to non-Premium users; this does not make every Business feature universally available.
Route both directions correctly
Map the channel, bot or account, customer chat and message identifiers. Names and avatars help staff recognize people but are unsuitable as routing keys: names can change or be duplicated.
Identify incoming photos, voice messages, videos and files, and fetch attachments through controlled access. Associate staff replies with the correct conversation. Distinguish confirmed delivery, failure and an uncertain result.
Connect tickets and CRM records
Start with one workflow: receive a question, create a ticket, let a staff member reply and confirm the customer receives it. Add assignment, labels, saved replies and order associations afterward.
Retries must not create duplicate tickets. Verify order associations instead of binding a customer merely because a message contains a recognizable string. Limit staff access to the conversations they are authorized to handle.
Separate delivery, reading and notifications
Standard Bot API does not expose every read-state capability available to a user client. “Viewed by staff,” “sent” and “read by customer” are different facts. Show customer-read status only when the selected interface provides evidence.
A mobile notification can say that a message is waiting without exposing its body on the lock screen. Retrieve content after the user opens the protected conversation.
State encryption boundaries precisely
HTTPS, encrypted storage and end-to-end encryption protect different parts of the system. Ordinary Bot conversations are not Telegram Secret Chats. Encrypting your server-to-admin connection does not make the entire customer-to-agent route end-to-end encrypted.
Define who holds keys, which services can decrypt, and how attachments and backups are handled. See session and privacy design.
Apply only for the credentials you need
For a user-account integration, follow the application guide. If the portal returns ERROR, contact GetTGAPI at gettgapi.com/en/help#contact; access-code holders can use the application entry.
For a standard bot, obtain its Token through BotFather first. GetTGAPI provides application assistance, not bot creation or a completed CRM.