HKUDS/Vibe-Trading · error · ValueError

webhook_secret_token must be 1-256 characters using only A-Z

Error message

webhook_secret_token must be 1-256 characters using only A-Z, a-z, 0-9, _ and -

What it means

Raised when the Telegram webhook secret token exceeds 256 characters or contains characters outside A-Z, a-z, 0-9, underscore and hyphen. Telegram's Bot API setWebhook only accepts secret_token values of 1-256 chars from this exact alphabet, so the config is rejected before an API call can fail.

Source

Thrown at agent/src/channels/telegram.py:417

            raise ValueError('webhook_path must start with "/"')
        return value

    @model_validator(mode="after")
    def validate_webhook_config(self) -> "TelegramConfig":
        if self.mode != "webhook":
            return self

        url = self.webhook_url.strip()
        if not url:
            raise ValueError("webhook_url is required when Telegram mode is webhook")
        parsed = urlparse(url)
        if parsed.scheme != "https" or not parsed.netloc:
            raise ValueError("webhook_url must be a public HTTPS URL")
        secret = self.webhook_secret_token.strip()
        if not secret:
            raise ValueError("webhook_secret_token is required when Telegram mode is webhook")
        if len(secret) > 256 or re.match(r"^[A-Za-z0-9_-]+$", secret) is None:
            raise ValueError(
                "webhook_secret_token must be 1-256 characters using only A-Z, a-z, 0-9, _ and -"
            )
        return self


class TelegramChannel(BaseChannel):
    """
    Telegram channel using long polling or webhook mode.

    Long polling is the default. Webhook mode requires a public HTTPS URL and a
    Telegram secret token.
    """

    name = "telegram"
    display_name = "Telegram"

    # Commands registered with Telegram's command menu
    BOT_COMMANDS = [

View on GitHub (pinned to 80ffdda44c)

Solutions

1. Regenerate the secret as hex or urlsafe-base64 without padding: openssl rand -hex 32 or secrets.token_hex(32)
2. Strip or re-encode any base64 secret to hex before assigning it
3. Ensure the token is 1-256 characters after stripping whitespace

Example fix

# before
webhook_secret_token = base64.b64encode(os.urandom(32)).decode()  # may contain + / =
# after
webhook_secret_token = secrets.token_hex(32)  # only 0-9a-f, always valid

import re

def valid_secret(s: str) -> bool:
    s = s.strip()
    return bool(s) and len(s) <= 256 and re.fullmatch(r"[A-Za-z0-9_-]+", s) is not None

assert valid_secret(webhook_secret_token), "secret must be 1-256 chars of [A-Za-z0-9_-]"

def is_valid_secret(s: str) -> bool:
    return bool(re.fullmatch(r"[A-Za-z0-9_-]{1,256}", s.strip()))

When it happens

Trigger: Setting webhook_secret_token to a value containing '=', '+', '/', '.', or other symbols (typical of base64 strings or full JWTs), or pasting a very long key. The validator applies re.match(r"^[A-Za-z0-9_-]+$", secret) after stripping whitespace.

Common situations: Using a base64-encoded secret (contains + / =) generated by a secret manager; pasting a JWT or an SSH key as the token; using hex-with-colons UUID strings; concatenating secrets with separators like ':'.

Related errors

• webhook_secret_token is required when Telegram mode is webho
• invalid alpha_id
• alpha_id not found
• invalid period: {exc}
• too many running benches; wait for one to finish

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/07489a51c243a26f. Report an issue: GitHub.