Payments in bots: Telegram Payments and Stars, Discord monetization and checkout links

Golden rules

• Never collect card data in messages. Card details in chat logs put you in scope of PCI DSS and expose users. Use native payment UIs or a hosted checkout page.
• Fulfill on verified events, not on a "thank you" redirect or a button press.
• Make fulfillment idempotent, keyed by the payment ID, because events can arrive twice.

Telegram

Telegram's Bot Payments API supports two cases:

• Physical goods and services: use sendInvoice (or createInvoiceLink) with a provider_token from a supported payment provider connected in BotFather.
• Digital goods and services: must be sold in Telegram Stars, currency XTR, with an empty provider token. See payments for digital products.

The flow:

1. Send an invoice with a payload you can map to an order.
2. Telegram sends a pre_checkout_query. Check stock and price and call answerPreCheckoutQuery quickly (Telegram allows 10 seconds).
3. On success you receive a message with successful_payment, including telegram_payment_charge_id. Fulfill and store that ID.
4. Refunds for Stars use refundStarPayment.

Provide a /terms command and a support contact for payment questions; Telegram expects bots that sell to handle disputes.

Discord

Discord's monetization lets eligible apps sell subscriptions and one-time items as SKUs. Purchases appear as entitlements: check them on interactions (entitlements field) or through the API, and listen to entitlement events to grant or remove access. Availability depends on the app's region and eligibility.

Slack, WhatsApp and others

• Slack has no in-app payment API. Link to a hosted checkout and confirm the result back in Slack.
• WhatsApp offers native payments only in a few countries; elsewhere, send a checkout link.
• Messenger, Matrix, Twitch: use external checkout.

External checkout

1. Create a checkout session on your payment provider with your order ID in metadata.
2. Send the link (a button in the chat). Short sessions and single-use links reduce abuse.
3. Receive the provider's webhook, verify its signature (webhook signature generator) and fulfill.
4. Message the user with a receipt. Map the payment to the chat user with the stored order, never with data the user types.

Operations

• Keep an append-only ledger of orders, payment IDs and status changes.
• Reconcile daily against the provider's reports.
• Handle refunds and chargebacks: revoke access, notify the user.
• Taxes and consumer law vary by country; digital goods often need VAT handling and clear refund terms. Get professional advice. See legal, terms and privacy.
• Test with sandbox or test modes and a staging bot. Telegram provides test environments for providers.