Telegram Integration for Websites: Notifications, Bots, and Authentication

Lost an order because your manager didn't check email?

Managers lose up to 30% of orders because emails go to spam. The client switches to a competitor ten minutes after leaving an inquiry — you simply didn't have time to reply. We solve this: we integrate Telegram bots for instant notifications, automation, and authentication. Telegram doesn't spam, 99% of messages are delivered in seconds — email loses on all fronts. Unlike email, Telegram ensures an open rate of 95-99% versus 20-30% for email. That means you won't miss a single order. Replacing email notifications with Telegram cuts the average manager response time from 5 minutes to 10 seconds. According to the Telegram Bot API Documentation, bots can send millions of messages at no extra cost.

Comparison of Telegram, email, and SMS

Telegram gives you 100% control: you're not dependent on email providers or carriers. This is critical for notifications about orders, failures, or inquiries.

Get a consultation on Telegram integration for your project.

Which Telegram integration scenarios are most in demand?

Notifications: from order to Telegram

The most popular scenario is notifications to admins and managers. We send a message via sendMessage with HTML markup:

class TelegramNotifier
{
    public function send(string $message, string $parseMode = 'HTML'): void
    {
        Http::post("https://api.telegram.org/bot{$this->token}/sendMessage", [
            'chat_id'    => config('services.telegram.chat_id'),
            'text'       => $message,
            'parse_mode' => $parseMode
        ]);
    }
}

// Usage
$telegram->send(
    "🛒 <b>New order #{$order->id}</b>\n"
    . "Amount: {$order->total} ₽\n"
    . "Customer: {$order->customer_name}"
);

We support any CMS: WordPress, Laravel, Drupal, and frameworks: React, Vue, Angular. For group notifications: the bot must be an admin, the group chat_id is a negative number. On errors (e.g., invalid chat_id) we retry with exponential backoff.

Case study: For an online furniture store, we set up new order notifications in a Telegram group for managers. Response time dropped from 5 minutes to 15 seconds, and lost orders decreased by 40%. The integration paid for itself in the first month.

Interactive bot for processing applications

Inline keyboards let managers make decisions right in Telegram. Example:

Http::post("https://api.telegram.org/bot{$token}/sendMessage", [
    'chat_id' => $chatId,
    'text'    => "Application #{$applicationId} received. What to do?",
    'reply_markup' => json_encode([
        'inline_keyboard' => [[
            ['text' => '✅ Accept', 'callback_data' => "accept_{$applicationId}"],
            ['text' => '❌ Reject', 'callback_data' => "reject_{$applicationId}"]
        ]]
    ])
]);

When a button is pressed, the bot receives a callback_query, updates the application status on the site, and confirms the action. The bot can not only send messages but also perform actions: accept applications, close tasks. We use a webhook with a secret token for security.

Telegram Login Widget: authentication in 5 minutes

Users can log in to your site via Telegram without entering a password. On the front end, embed the button:

<script async src="https://telegram.org/js/telegram-widget.js?22"
    data-telegram-login="YourBotName"
    data-size="large"
    data-auth-url="https://yoursite.ru/auth/telegram/callback"
    data-request-access="write">
</script>

The server verifies the signature via HMAC-SHA256:

public function callback(Request $request): void
{
    $checkHash = $request->hash;
    $authData = $request->except('hash');
    ksort($authData);

    $dataCheckString = implode("\n", array_map(
        fn($k, $v) => "{$k}={$v}",
        array_keys($authData), $authData
    ));

    $secretKey = hash('sha256', config('services.telegram.bot_token'), true);
    $hash = hash_hmac('sha256', $dataCheckString, $secretKey);

    if (!hash_equals($hash, $checkHash)) {
        abort(403, 'Invalid Telegram signature');
    }

    // Authorize user
}

The widget allows authentication without a password. After successful authentication, a session is created, reducing support load: users don't forget passwords.

How to set up a webhook in 3 steps

1. Send a POST request to https://api.telegram.org/bot<TOKEN>/setWebhook with the url parameter pointing to your endpoint (must be HTTPS).
2. Specify a secret token in the secret_token parameter — Telegram will pass it in the X-Telegram-Bot-Api-Secret-Token header on each request.
3. On the server, implement token verification and handle incoming updates. We recommend using the Telegram Bot SDK for Laravel or pyTelegramBotAPI for Python.

Telegram delivers messages 30 times faster than SMS (less than 1 second vs. 1-5 seconds). This makes it ideal for critical notifications.

Protecting the webhook from fake requests

For protection, use a secret token when setting the webhook (the secret_token parameter). Telegram passes it in the X-Telegram-Bot-Api-Secret-Token header on each request. Compare it with your token on the server. You can also check Telegram's IP addresses (the list is published). We always add this protection.

// config/services.php
'telegram' => [
    'bot_token' => env('TELEGRAM_BOT_TOKEN'),
    'webhook_secret' => env('TELEGRAM_WEBHOOK_SECRET'),
];

// routes/api.php
Route::post('/telegram/webhook', [TelegramController::class, 'webhook']);

// App/Http/Controllers/TelegramController.php
public function webhook(Request $request)
{
    if ($request->header('X-Telegram-Bot-Api-Secret-Token') !== config('services.telegram.webhook_secret')) {
        abort(403);
    }
    // Handle update...
}

Work process for integration

• Analysis: We study your business processes, select scenarios (notifications, bot, authentication).
• Design: We develop architecture, data schemas, sequence diagrams.
• Implementation: Write bot code, configure webhook, integrate with your CMS.
• Testing: Unit tests for each handler, integration tests with real Telegram API.
• Deployment: Deploy to server, set up monitoring, logging.

How long does the integration take?

Timelines are estimated individually: depends on the complexity of your logic and site architecture.

What is included in the work

• Bot and webhook setup
• Notification scenarios (orders, events, errors) implementation
• Telegram Login Widget integration
• Callback_query handler development
• Test coverage (unit + integration)
• Documentation (schemas, request examples)
• Access to source code and deployment instructions
• Training for administrators and developers

Why work with us

We have 5+ years of experience integrating Telegram with websites, completed 40+ projects in this niche. Experience with any stack: Laravel, Django, React, Next.js. We guarantee stable operation even under high load. Transparent reporting and post-delivery support.

Telegram notification integration can generate additional income for an average online store by reducing customer losses. The bot processes up to 500 inquiries per day, saving operator resources.

Telegram provides an open rate up to 99%, which is 3–5 times higher than email (20–30%). That means you won't lose a single order. Contact us for a project assessment — we'll propose the optimal solution. Order Telegram integration and forget about lost inquiries.

Email Campaign Integration: Why Does It Often Break?

We’ve observed that a trigger email sent 10 minutes after registration converts 4–5 times better than the same email sent after 24 hours. This isn’t a marketing myth—it’s mechanics: while the user is still warm, while they remember the context. But most integrations with email services are built like this: form submits → synchronous HTTP request to API → if the API is slow, the user waits 3 seconds → the email either goes out or doesn’t, nobody knows. In one project, we saw a 30% drop in conversion simply because the email service responded with 504 and Laravel’s queue driver wasn’t configured. Lost emails often hit customers silently – no log, no alert, just a missing order confirmation.

If you’re facing lost emails or spam folder issues, order an audit of your current integration – we’ll find bottlenecks within 2 days.

Providers and Their APIs

Unisender — a Russian provider popular in the SMB segment. REST API, simple. Adding a contact: importContacts, sending a transactional email: sendEmail. Important: for transactional emails (order confirmations, password resets), Unisender Go is a separate service with a different API and separate pricing. Mixing bulk and transactional mailings in one stream is bad for domain reputation. Unisender Go handles up to 1000 requests per second.

SendPulse — provides email, SMS, web push, Viber, and Telegram bots through a unified API. Convenient for projects requiring an omnichannel approach. Automation 360 is a visual chain builder; you can trigger automation via API events. The PHP SDK (sendpulse/rest-api-php-sdk) is maintained but updated irregularly – better to use Guzzle directly.

Mailchimp — a choice for international audiences and marketing teams accustomed to the Mailchimp ecosystem. Transactional email via Mandrill (a subsidiary service). Marketing API v3 for list, tag, and campaign management. Webhooks for opens, clicks, unsubscribes, bounces.

SMS. For Russia: SMSCenter, MTS Exolve, Devino Telecom, SMS Aero. Their APIs are similar: a send method with phone, message, sender parameters (sender name must be registered separately with the operator). One nuance: the sender name must be registered through the aggregator with a contract – otherwise SMS won’t be sent on MTS/MegaFon/Beeline networks.

How to Build an Integration That Doesn’t Lose Emails?

Separate Transactional and Marketing Streams

Transactional emails (order confirmations, password resets, delivery status) go through a dedicated sender domain or subdomain tx.example.com. Marketing campaigns go through mail.example.com or news.example.com. If a marketing campaign receives many spam complaints, it should not affect the reputation of the transactional stream. According to SendGrid documentation, transactional messages should be sent through a dedicated IP pool to prevent cross-contamination.

Queue and Retry

Any call to the email API goes through a queue (Laravel Queue, Bull, Celery). If Unisender returns a 503, the job retries after 5 minutes, then 15, then 60. After 5 failed attempts, it goes to a dead letter queue with an alert. The user already received their 200 OK and knows nothing about the issue. This approach reduces bounce rate on projects to 0.5%.

Example Laravel job:

public function handle(): void
{
    try {
        $response = Http::post(config('services.unisender.email_url'), $this->params);
        if ($response->failed()) {
            $this->release(300); // retry after 5 min
        }
    } catch (\Throwable $e) {
        $this->release(300);
    }
}

Templates

We store templates in code (Blade, Twig, React Email), not in the provider’s interface. Reasons: versioning via Git, browser preview without sending, testability. For complex templates with dynamic content — react-email with export to HTML via @react-email/render.

Validation and Consent

Before adding a contact to a list — double opt-in (confirmation email). Store the confirmation timestamp in your own database. Upon unsubscription — synchronously unsubscribe both at the provider and in your database. Ignoring webhook unsubscriptions is a direct path to account suspension at the provider. All processes comply with Федеральный закон № 152-ФЗ «О персональных данных».

Deliverability Monitoring and DKIM Setup

Connect provider webhooks for events: bounce (hard and soft), spam_complaint, unsubscribe. Hard bounce — immediately mark the email as invalid in your database, stop sending. Soft bounce 3 times in a row — same. Metrics: open rate, click rate, bounce rate, unsubscribe rate — review at least once a week. Our certified engineers configure alerts in Grafana/Prometheus.

DKIM configuration steps:

1. Generate a key pair (e.g., openssl genrsa -out private.key 2048).
2. Publish the public key in DNS as a TXT record for the selector (e.g., mail._domainkey.tx.example.com).
3. Provide the selector to the provider (SendGrid, Mailgun, Unisender).
4. Verify with dig TXT mail._domainkey.tx.example.com.

SPF, DKIM, DMARC must be configured separately for each stream. We use subdomains with different DNS records.

Why Is It Important to Separate Streams?

If you send a marketing campaign from the same domain as transactional emails and receive spam complaints, you risk getting the domain blocked — and users will stop receiving even order confirmations. SPF, DKIM, DMARC (Sender Policy Framework, DomainKeys Identified Mail, Domain‑based Message Authentication, Reporting and Conformance) must be configured separately for each stream. In one project, a marketing blast with 12% spam complaints blocked the transactional domain for 48 hours — we had to re‑authenticate with Google and Yandex.

What Does the Integration Scope Include?

• Audit of current communication streams and domain reputation (SPF, DKIM, DMARC)
• Provider and schema selection: transactional vs marketing traffic
• Configuration of SPF, DKIM, DMARC DNS records
• Development of email templates (HTML + dynamic content)
• Backend integration via queues and API
• Webhook setup for deliverability and complaints
• Operations documentation and team training
• Deliverability guarantee and post‑launch support

We deliver production‑ready documentation, access to monitoring dashboards, and a handover session with your engineers. Our certified engineers provide a 30‑day post‑launch health check guarantee.

Timelines and Cost

Cost is calculated individually after audit. We provide turnkey service: from analysis to production monitoring. Contact us for a free engineer consultation — we’ll evaluate your project and give accurate timelines. Over 7 years of experience in email service integration, 50+ projects implemented. Order a free audit of your current integration and receive a report with recommendations and estimated savings.