automation
How to Set Up Deposit Webhooks From a Payment Gateway to Telegram Alerts
Step-by-step guide to routing payment gateway deposit webhooks into Telegram alerts: verify signatures, dedupe events, respect rate limits, and notify your team.
Key takeaways
A deposit alert needs a public endpoint, signature verification, deduplication by event ID, and a Telegram Bot API call.
Stripe's docs say to skip already-processed events and return a 200 response to stop retries.
Per Telegram's Bots FAQ, bots should stay near one message per second per chat.
crmchat webhooks and API can tie each deposit to a Telegram contact.
You set up deposit webhooks by registering an HTTPS endpoint with your payment gateway, verifying each signature, ignoring duplicate events, and forwarding a short message to a Telegram chat through the Bot API. Respond with a success status fast, and do the Telegram call afterward.
What do you need before connecting a payment gateway to Telegram?
You need a Telegram bot token, a chat ID for the alert destination, a small server or automation tool that can receive HTTPS requests, and a webhook signing secret from your gateway.
Create the bot with @BotFather, add it to your team group or channel, and note the chat ID. Store the bot token and signing secret in environment variables, never in code.
If you do not want to write a server, n8n, Make, or Zapier can act as the receiver. The logic stays the same in every tool.
Create a bot in @BotFather and copy the token.
Add the bot to your alerts chat and send one test message.
Read the chat ID from the bot's getUpdates response.
Generate the webhook signing secret in your gateway dashboard.
Deploy an HTTPS endpoint that accepts POST requests.
How do you verify a deposit webhook is genuine?
You verify a webhook by recomputing the signature from the raw request body and your signing secret, then comparing it to the signature header. Reject the request if the two do not match.
Use the raw body, not a parsed and re-serialized version, or the digest will differ. Compare with a constant-time function.
Stripe adds a timestamp to its Stripe-Signature header. Because the timestamp is part of the signed payload, an attacker cannot change it without breaking the signature, and your app can reject old payloads, per Stripe's webhook docs. The same docs warn against a tolerance value of 0, which disables the recency check.
Other gateways use their own header names and algorithms, so read your provider's signature page before you copy this logic.
How do you stop duplicate deposit alerts?
You stop duplicates by storing each event ID and skipping any ID you have already handled. Gateways retry on failures, so the same deposit can arrive more than once.
Stripe's documentation says to skip an event you already processed and return a 200 response to stop further retries. Stripe also generates a new signature and timestamp for each retry, per its webhook docs, so never use the signature as your dedupe key. Use the event ID.
Extract the event ID from the payload.
Look it up in a database table or key-value store.
If it exists, return a success response and stop.
If not, save the ID, then send the Telegram message.
Return a success response to the gateway.
Save the ID before sending, or mark it as pending, so two parallel deliveries cannot both pass the check.
How do you send the Telegram alert?
You send the alert by calling the Bot API sendMessage method with your chat ID and a short text built from the deposit fields. Keep the message to amount, currency, customer, and status.
A useful alert looks like this: "Deposit confirmed: amount and currency, user @handle, order ID." Skip card data and anything you would not paste into a group chat.
Mind the limits. Telegram's Bots FAQ says a bot should avoid more than one message per second in a single chat, and bursts eventually trigger 429 errors. The same FAQ says bulk notifications are capped at about 30 messages per second unless you enable paid broadcasts.
On high-volume days, batch small deposits into one summary message and send large ones instantly. Add a retry with backoff for 429 responses.
How do you link a deposit to a contact in your CRM?
You link a deposit to a contact by matching the payer's Telegram username or ID to a CRM record and updating that record when the payment arrives. That gives your sales team context, not only a notification.
crmchat includes a REST API that lets you list contacts filtered by telegram.username and telegram.id, then update fields such as a custom deposit status property. See the crmchat API for the full endpoints.
crmchat also handles outbound events with webhooks that fire on contact.created, contact.updated, and contact.deleted, each signed with an HMAC-SHA256 header. That means a deposit status change on a contact can trigger a second workflow in n8n, Make, or Zapier.
The crmchat knowledge base also notes that a Stripe payment or any other trigger can start a Telegram outreach sequence, so a first deposit can launch a welcome message automatically.
For iGaming teams, deal owners already get Telegram alerts when a lead replies. Deposit alerts add the payment side of that picture. For payment risk context, read vetting high-risk processors.
How do you test and monitor the setup?
You test the setup by sending sandbox events from your gateway, confirming one Telegram message per event ID, and then forcing failures to see how retries behave. Do this before you go live.
Send a test deposit event and confirm the alert arrives once.
Replay the same event and confirm no second alert appears.
Send a payload with a wrong signature and confirm a rejection.
Return a server error on purpose and watch the gateway retry.
Log every event ID, status, and Telegram response code.
Set an alert for when no deposits arrive for an unusual period.
If alerts stop arriving, check endpoint certificates and bot permissions first. Our guide on stopped Telegram webhooks covers the Telegram side. For big transfers, add a human step with a two-person approval process.
FAQ
Can I send deposit webhooks straight to Telegram without a server?
Not directly, because a gateway posts its own payload format and Telegram expects a Bot API call. Use a no-code tool such as n8n, Make, or Zapier as the middle step, or a small serverless function.
Why do I get the same deposit alert twice?
Gateways retry when they do not get a success response in time, so duplicates are normal. Store event IDs and, as Stripe's docs advise, skip events you have already processed and return a 200 response.
How many Telegram alerts can a bot send per second?
Telegram's Bots FAQ says to stay under about one message per second in a single chat. Bulk notifications are capped near 30 messages per second without paid broadcasts.
Should I post deposit alerts in a group or a private chat?
Use a private team group with only the people who need to see payments. Keep sensitive details out of the message and link to your CRM record instead.
