Build Telegram bots that earn Stars.

# Point Telegram at your Worker. Telegram sends the secret back in a header.
curl "https://api.telegram.org/bot$BOT_TOKEN/setWebhook" \
  -d "url=https://my-bot.example.workers.dev/" \
  -d "secret_token=$WEBHOOK_SECRET" \
  -d 'allowed_updates=["message","pre_checkout_query"]'

// The two updates that matter for payments (excerpt of src/index.ts)
if (update.pre_checkout_query) {
  const q = update.pre_checkout_query;
  // Answer within 10 seconds, or Telegram cancels the payment.
  await tg(env, "answerPreCheckoutQuery", {
    pre_checkout_query_id: q.id,
    ok: q.currency === "XTR" && q.total_amount === PRO_STARS,
    error_message: "This invoice is out of date. Send /pro again.",
  });
}

const p = update.message?.successful_payment;
if (p) {
  // Save the charge ID first: refundStarPayment needs it.
  await savePurchase(env, p.telegram_payment_charge_id, update.message.from.id, p.invoice_payload);
  await unlockPro(env, p.invoice_payload); // per user or per group
}

Excerpt. The full Worker, with tg(), /terms and /paysupport, is in the Stars guide. Checked against the Bot API docs on 2026-10-28.

// validate.ts — check Telegram.WebApp.initData on a Cloudflare Worker (Web Crypto, no deps)
const enc = new TextEncoder();

async function hmac(key: BufferSource, msg: string): Promise<ArrayBuffer> {
  const k = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
  return crypto.subtle.sign("HMAC", k, enc.encode(msg));
}
const hex = (b: ArrayBuffer) => [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");

export async function validateInitData(initData: string, botToken: string, maxAgeSec = 3600) {
  const params = new URLSearchParams(initData);
  const hash = params.get("hash");
  if (!hash) return null;
  params.delete("hash");

  // data-check-string: every other field, sorted by key, "key=value", joined by "\n"
  const dataCheckString = [...params.entries()]
    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
    .map(([k, v]) => `${k}=${v}`)
    .join("\n");

  const secretKey = await hmac(enc.encode("WebAppData"), botToken); // key = "WebAppData"
  const expected = hex(await hmac(secretKey, dataCheckString));

  // Constant-time compare
  if (expected.length !== hash.length) return null;
  let diff = 0;
  for (let i = 0; i < hash.length; i++) diff |= expected.charCodeAt(i) ^ hash.charCodeAt(i);
  if (diff !== 0) return null;

  const authDate = Number(params.get("auth_date"));
  if (!authDate || Date.now() / 1000 - authDate > maxAgeSec) return null; // too old

  return { user: JSON.parse(params.get("user") ?? "null"), startParam: params.get("start_param") };
}