Send the bot token in the Authorization: Bearer <token> header and keep it on your server.
Overview
The Bot API base URL is https://call.mp.net/bot/{methodName}. For example, call getMe to verify your bot.
curl --silent --show-error "https://call.mp.net/bot/getMe" \
-H "Authorization: Bearer ${MPCHAT_BOT_TOKEN}"
Existing integrations can still authenticate at https://call.mp.net/bot/bot{MPCHAT_BOT_TOKEN}/{methodName}. If both credentials are present, the API uses the Bearer token.
Token safety rules
Not in the frontend — never in WebView, browser, or mobile code.
Redact the
Authorizationheader and token-bearing legacy URLs from application logs, proxy access logs, tracing, and error reports.Not in version control — add
.envto.gitignore; inject via CI secrets.Not in chat — never paste a real token into tickets, IM, or AI conversations.
Rotate on leak — revoke immediately in BotFather and replace.
HTTP methods and content types
Most write operations are POST.
getMe,getUpdates,getWebhookInfo, andgetMyCommandsalso accept GET.application/jsonfor the vast majority of write methods.multipart/form-datafor local media uploads (sendPhoto,sendVideo,sendDocument,setChatPhoto).
ID type rules
chat_id, user_id, and message_id accept a JavaScript safe integer (0 to 9007199254740991) or a decimal string in the same range. Store as BIGINT or VARCHAR and mind JSON precision.
Rate limits
Default is 30 requests/second per token; exceeding it returns 429. Production code must implement exponential backoff (see the production checklist).
Pre-request checklist
Token read from an environment variable.
ID types match the documented rules.
POST body is valid JSON.
Media methods use a public URL or multipart (no
file_idreuse).
Related
Keep separate tokens for test and production bots. A leaked token should be revoked before anything else.