This article is for those curious about what happens between the "Remind me in Telegram" button and the message in the messenger. You can use reminders without knowing any of this, but trusting a channel is easier when you understand how it works.
Why one bot and not one per salon
We could ask every salon to create a bot through BotFather, paste the token into the settings and set up a webhook. A specialist working alone would give up at step two. And rightly so: they came to take bookings, not to administer bots.
So there is one bot for the whole platform. The client sees the salon's name in the message text; the sender is shared. That is honest: the person subscribed to a service's reminders, not to a chat with the specialist.
A salon that wants its own bot with its own name connects it as an integration. That is a separate channel, and it works as before.
What is inside the subscription link
The button on the booking page leads to t.me/<bot>?start=<token>. The token has four parts:
777-52-1788438490-a3d2dc5d8e7c8e76e359
│ │ │ └─ signature
│ │ └─ expiry
│ └─ company
└─ client
No state is stored on the server: no table, no cache entry. The token lives for a day and is verified by its signature, so it survives a server restart and a cache flush, and nothing needs to be cleaned up on a schedule.
Why the signature is so short
The signature in the token is 20 characters, 80 bits. That is not thrift. Telegram limits the /start payload to 64 characters, and three numbers have to fit in there too. A full signature would not.
80 bits for a token that lives a day and grants the right to receive reminders about one visit is plenty. Brute-forcing it costs more than calling the salon and asking when the appointment is.
The signature check uses a constant-time comparison. An ordinary string comparison stops at the first mismatched character, and the response time would let someone guess the signature one character at a time.
Anything that does not match is rejected: a forged signature, a substituted client or salon, an expired token. There is a test that tampers with each part.
What the bot does
| Command | Action |
|---|---|
/start with a token | Links the chat to the client card |
/start without a token | Explains that it must be opened from the booking page |
/stop | Unsubscribes from all salons at once |
| any text | Explains that the bot does not chat |
/stop unsubscribes everywhere on purpose. A person is opting out of messages, not out of one specialist, and is not obliged to remember how many salons there were. Asking them to clarify would mean not unsubscribing.
The bot replies to random text rather than staying silent. A silent bot looks broken, and the client comes back to the salon asking "does it even work?". But it does not chat and does not pretend to: the person would be waiting for the specialist's reply.
How the entry point is protected
The address Telegram sends updates to is open to the whole internet, otherwise Telegram could not reach it. The only thing that separates a real update from a fake one is a secret in the header, set by our own call when the webhook is configured.
The check fails closed rather than open: no secret configured means refusal. Without it anyone could send an update with someone else's token and subscribe their own chat to reminders about someone else's visits, learning who goes where and to whom.
What it means for the salon
Nothing to configure. The button appears by itself when the platform bot is enabled and does not appear when it is not: a link to a non-existent bot is worse than no link. Once the client subscribes, reminders go out free of charge and without limits.
Comments
No comments yet. Ask your question — we answer within a day.