workflow recipe
n8n Telegram AI Bot Workflow With Guardrails
Use Telegram to receive messages, IF to filter supported commands, Set or Code to build a compact prompt, OpenAI to generate a reply, and Telegram to send the response.
- Use when
- n8n workflows, Telegram, OpenAI, AI bot
- First check
- Receive Telegram messages or commands through the Telegram node.
- Time to check
- 5-10 minutes
- Next step
- Run the recommended steps, then verify a production execution.
Independent third-party notes. n8n is a trademark of its owner and is referenced only for compatibility and troubleshooting context.
Quick Answer
Use Telegram to receive messages, IF to filter supported commands, Set or Code to build a compact prompt, OpenAI to generate a reply, and Telegram to send the response.
Problem Pattern
Telegram AI bots get messy when they answer every message, leak private chat content into prompts, or fail to handle long, empty, or command-style messages.
Version awareness
Last reviewed 2026-05-21
Key Facts
- Input
- Telegram messages should be filtered before reaching an AI node.
- Prompt
- A compact prompt reduces noise and accidental over-sharing.
- Output
- Telegram replies should be length-controlled and safe for the chat context.
- Abuse control
- Public bots need rate, command, and permission controls.
Recommended Steps
- Receive Telegram messages or commands through the Telegram node.
- Filter unsupported commands, empty text, and unauthorized chat IDs.
- Use Set or Code to create a short prompt with only necessary context.
- Call OpenAI and format the reply.
- Send the response back through Telegram and log failures safely.
Verification
- Allowed commands receive a response.
- Unauthorized or unsupported messages are ignored.
- Long messages are handled without breaking the workflow.
- The response does not include hidden prompt or sensitive data.
Warnings
- Do not feed private chat history into AI prompts without consent.
- Public bots can be abused if they respond to every user.
- Model output should not be treated as authoritative advice.
Best For
- Internal helper bots
- FAQ assistants
- Small team automation commands
Not For
- Public high-volume bots without abuse controls
- High-stakes advice without human review
Common Mistakes
- Replying to every Telegram message.
- Forgetting chat ID allowlists.
- Passing entire chat history into prompts.
- Ignoring long message limits and API failures.
Examples
Telegram: receive message
IF: text starts with /ask and chat_id allowed
Set: clean question and system context
OpenAI: generate concise answer
Telegram: send replyWorkflow Build Brief
This page is a build brief, not a direct import template yet. Use it to build safely and document production assumptions.
Node order
- Receive Telegram messages or commands through the Telegram node.
- Filter unsupported commands, empty text, and unauthorized chat IDs.
- Use Set or Code to create a short prompt with only necessary context.
- Call OpenAI and format the reply.
- Send the response back through Telegram and log failures safely.
Credential checklist
- Create least-privilege credentials for each external app.
- Record scopes and destination IDs before activation.
| Source field | Destination field | Notes |
|---|---|---|
| provider event ID | dedupe key | Required before side effects. |
| normalized payload | message/content/action fields | Keep secrets out of generated text. |
Build brief, not direct import
The workflow needs account-specific credentials, destination IDs, dedupe storage, and provider-specific event shapes before a real JSON template would be safe to import.
{
"eventId": "evt_example_build_brief",
"payload": "replace with provider sample"
}{
"accepted": true,
"nextStep": "replace with destination-specific result"
}Failure paths
- Provider retries create duplicates.
- Credential scope is broader or narrower than required.
- Destination IDs differ between test and production.
Activation checklist
- Run with provider test event.
- Verify dedupe.
- Verify error branch.
- Confirm no secrets appear in outputs.
Duplicate prevention: Store or compare the provider event ID before sending Slack messages, charging actions, or generated content.
{
"eventId": "test-001",
"mode": "dry-run"
}What to change before import
- Credential names
- Destination IDs
- Event sample fields
- Dedupe storage
FAQ
Should the bot respond in every chat?
No. Start with an allowlist or command filter so the workflow is not abused.
Can I include chat history?
Only include the minimum context needed and make sure privacy expectations are clear.