Accept Telegram Stars in your bot.

// tg.ts — tiny Bot API client for Cloudflare Workers (no SDK needed)
export interface Env {
  BOT_TOKEN: string;      // from @BotFather. Store with: wrangler secret put BOT_TOKEN
  WEBHOOK_SECRET: string; // any random string; also passed to setWebhook
  DB: D1Database;         // purchases table (or KV / Durable Objects)
}

export async function tg<T = unknown>(env: Env, method: string, body: object): Promise<T> {
  const res = await fetch(`https://api.telegram.org/bot${env.BOT_TOKEN}/${method}`, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify(body),
  });
  const data = (await res.json()) as { ok: boolean; result: T; description?: string };
  if (!data.ok) throw new Error(`${method} failed: ${data.description}`);
  return data.result;
}

-- schema.sql (D1). Keep every charge ID: refunds need it.
CREATE TABLE IF NOT EXISTS purchases (
  charge_id TEXT PRIMARY KEY,   -- telegram_payment_charge_id
  user_id   INTEGER NOT NULL,
  payload   TEXT NOT NULL,      -- e.g. "pro:-100123456"
  stars     INTEGER NOT NULL,
  at        INTEGER NOT NULL
);
CREATE INDEX IF NOT EXISTS purchases_user ON purchases (user_id);
CREATE INDEX IF NOT EXISTS purchases_payload ON purchases (payload);

# Point Telegram at your Worker. Telegram sends the secret back in a header.
curl "https://api.telegram.org/bot$BOT_TOKEN/setWebhook" \
  -d "url=https://my-bot.example.workers.dev/" \
  -d "secret_token=$WEBHOOK_SECRET" \
  -d 'allowed_updates=["message","pre_checkout_query"]'

await tg("sendInvoice", {
  chat_id: chatId,
  title: "Pro",
  description: "Unlock Pro for this group. One payment.",
  payload: `pro:${chatId}`,     // your own ID, 1-128 bytes
  provider_token: "",            // empty string for Stars
  currency: "XTR",               // Telegram Stars
  prices: [{ label: "Pro", amount: 150 }], // exactly one item
});

// A link you can open from a Mini App, a button or a web page.
const url = await tg<string>(env, "createInvoiceLink", {
  title: "Pro",
  description: "Unlock Pro. One payment.",
  payload: `pro:${userId}`,
  provider_token: "",
  currency: "XTR",
  prices: [{ label: "Pro", amount: 150 }],
});
// url is an invoice link. Put it in a button, or open it in a Mini App.

// index.ts — a Cloudflare Worker bot that sells Pro for Telegram Stars
import { tg, type Env } from "./tg";

const PRO_STARS = 150;

export default {
  async fetch(req: Request, env: Env): Promise<Response> {
    // Only Telegram knows the secret we gave to setWebhook.
    if (req.headers.get("X-Telegram-Bot-Api-Secret-Token") !== env.WEBHOOK_SECRET) {
      return new Response("forbidden", { status: 403 });
    }
    const update: any = await req.json();

    // 1) pre_checkout_query: answer within 10 seconds or Telegram cancels.
    if (update.pre_checkout_query) {
      const q = update.pre_checkout_query;
      const valid =
        q.currency === "XTR" &&
        q.total_amount === PRO_STARS &&
        String(q.invoice_payload).startsWith("pro:");
      await tg(env, "answerPreCheckoutQuery", valid
        ? { pre_checkout_query_id: q.id, ok: true }
        : { pre_checkout_query_id: q.id, ok: false,
            error_message: "This invoice is out of date. Send /pro to get a new one." });
      return new Response("ok");
    }

    const msg = update.message;
    if (!msg) return new Response("ok");

    // 2) successful_payment: the only safe moment to deliver.
    if (msg.successful_payment) {
      const p = msg.successful_payment;
      await env.DB.prepare(
        "INSERT OR IGNORE INTO purchases (charge_id, user_id, payload, stars, at) VALUES (?, ?, ?, ?, ?)"
      ).bind(p.telegram_payment_charge_id, msg.from.id, p.invoice_payload, p.total_amount, Date.now()).run();
      await tg(env, "sendMessage", { chat_id: msg.chat.id, text: "⭐ Pro is on. Thank you!" });
      return new Response("ok");
    }

    // 3) Commands.
    const cmd = String(msg.text ?? "").split(/[\s@]/)[0];
    if (cmd === "/pro") {
      await tg(env, "sendInvoice", {
        chat_id: msg.chat.id,
        title: "Pro",
        description: "Unlock Pro for this chat. One payment, no renewal.",
        payload: `pro:${msg.chat.id}`,
        provider_token: "",
        currency: "XTR",
        prices: [{ label: "Pro", amount: PRO_STARS }],
      });
    } else if (cmd === "/terms") {
      await tg(env, "sendMessage", { chat_id: msg.chat.id, text: "Terms: https://example.com/terms" });
    } else if (cmd === "/paysupport" || cmd === "/support") {
      await tg(env, "sendMessage", { chat_id: msg.chat.id,
        text: "Payment problem? Reply here with what happened. We answer within 24 hours. Telegram support cannot help with purchases in this bot." });
    }
    return new Response("ok");
  },
};

TypeScript for Cloudflare Workers. Field names checked against the Bot API reference on 2026-10-28.

// Monthly subscription: only createInvoiceLink accepts subscription_period.
const url = await tg<string>(env, "createInvoiceLink", {
  title: "Pro monthly",
  description: "Pro features. Renews every 30 days.",
  payload: `sub:${userId}`,
  currency: "XTR",
  prices: [{ label: "Pro monthly", amount: 100 }], // max 10,000 Stars
  subscription_period: 2592000,                    // must be exactly 30 days
});

// Each renewal arrives as a new successful_payment:
//   p.is_recurring           true for subscription payments
//   p.is_first_recurring     true for the first one
//   p.subscription_expiration_date   Unix time when this period ends

// Stop renewal. The user keeps access until the current period ends.
await tg(env, "editUserStarSubscription", {
  user_id: userId,
  telegram_payment_charge_id: chargeId,
  is_canceled: true,   // pass false to let the user re-enable it
});

// Full refund of one Stars payment. The Stars go back to the user.
await tg(env, "refundStarPayment", {
  user_id: userId,
  telegram_payment_charge_id: chargeId, // saved from successful_payment
});
// Then turn Pro off for that payload in your database.

# The test environment is a separate Telegram. Make a new bot there with @BotFather,
# then call the API with /test/ before the method name:
curl "https://api.telegram.org/bot$TEST_TOKEN/test/getMe"