Secure Telegram Stars Payment Flow in PHP: sendInvoice pre_checkout_query successful_payment
Architecture Overview A Telegram Stars payment flow has three distinct phases. First, the bot sends an sendInvoice request containing a unique lead identifier and an HMAC-protected initData . The lead identifier is a 14-character hex string generated with bin2hex(random_bytes(7)) and stored in a database. Second, when the user taps the MainButton, the bot calls pre_checkout_query to verify the…
The Telegram Stars payment flow is structured into three key phases. Initially, the bot generates an invoice by transmitting a sendInvoice request to the user. This request includes a unique lead identifier and a HMAC-protected initData string. The lead identifier, a 14-character hex string, is created using bin2hex(random_bytes(7)) and then saved in a database.
Subsequently, upon the user tapping the MainButton, the bot invokes pre_checkout_query to authenticate the invoice, ensuring it has not been duplicated, the bot token remains valid, and the auth_date is recent. Upon successful payment, the successful_payment function is triggered, which updates the invoice status as paid, modifies the lead state, and notifies the user.
Any omission or incorrect validation at these stages could allow an attacker to manipulate the initData and subsequently redirect funds to an unauthorized account.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
