Yoke
A small Telegram bot that listens for messages, asks an AI for a thoughtful reply, and sends it back. This instance is locked down - only @iamyang and @i4n16 can chat with it, and the webhook itself sits behind a secret path and a shared header check.
Status
Registered
69
14
0
Security
The webhook is locked down in three layers. Each one has to pass for the bot to reply, and any layer that fails returns a polite non-reveal - 404 for a wrong path, 401 for a wrong header.
Secret header
Telegram is told the webhook's secret_token; every update it sends carries a signed x-telegram-bot-api-secret-token header. The handler compares it with timingSafeEqual before parsing the body.
Shared header
Telegram is told the webhook's secret_token; every update it sends carries an X-Telegram-Bot-Api-Secret-Token header. The handler also compares it with timingSafeEqual as a second layer.
Owner allow-list
The handler only generates AI replies for these Telegram usernames (or numeric IDs set via ALLOWED_USER_IDS). Anyone else gets a short denial.
Commands
Commands the bot recognises when @iamyang messages it.
/start
Greet the bot and see a quick intro of what it can do.
/auth
Confirm the active owner session and print the allow-list match.
/help
List every command and what each one does.
/ping
Get an instant latency check - useful when the bot feels slow.
/reset
Forget the recent chat context and start fresh in this chat.
/status
Show the bot's uptime, the model in use, and the webhook URL.
anything else
Free-form chat. The bot will reply with an AI-generated answer.
How it works
- 01
Owner messages the bot
Only allow-listed Telegram usernames (currently @iamyang) trigger AI replies - everyone else gets a short denial.
- 02
Telegram posts to the secret path
Telegram POSTs the update to the secret URL with an X-Telegram-Bot-Api-Secret-Token header set at registration time.
- 03
Layered checks pass
Path matches the secret (404 otherwise). Header matches (401 otherwise). Update is parsed and the user passes the allow-list.
- 04
Bot replies with AI
The model's reply is sent back to your Telegram chat through a single sendMessage call. The model is anthropic/claude-opus-4.8.
Notes
- Replies are generated by an AI, so they can be wrong. Treat them as a draft, not a final answer.
- The bot keeps a short rolling memory of the last few turns in each chat so follow-up questions make sense.
- Anyone who is not on the allow-list still counts toward the totals, but the AI is never invoked for them.