Mintplex-Labs/anything-llm · error

Invalid bot token: ${verification.error}

Error message

Invalid bot token: ${verification.error}

What it means

Returned by POST /telegram/connect when TelegramBotService.verifyToken() rejects the supplied bot token. verifyToken() builds a node-telegram-bot-api client and calls getMe(); Telegram's API answers 401 Unauthorized (or 404 Not Found) for wrong, revoked, or malformed tokens, and that library error is interpolated into this 400 response. A network-level failure to reach api.telegram.org also lands here, because any getMe() rejection marks the token invalid.

Source

Thrown at server/endpoints/telegram.js:93

  app.post(
    "/telegram/connect",
    [validatedRequest, isSingleUserMode],
    async (request, response) => {
      try {
        const { bot_token, default_workspace = null } = reqBody(request);
        if (!bot_token) {
          return response.status(400).json({
            success: false,
            error: "Bot token is required.",
          });
        }

        // Verify the token with Telegram API
        const verification = await TelegramBotService.verifyToken(
          String(bot_token)
        );
        if (!verification.valid) {
          return response.status(400).json({
            success: false,
            error: `Invalid bot token: ${verification.error}`,
          });
        }

        let workspaceSlug = null;
        if (default_workspace) workspaceSlug = String(default_workspace);
        else {
          const workspaces = await Workspace.where({}, 1);
          if (workspaces.length) workspaceSlug = workspaces[0].slug;
          else {
            const { workspace } = await Workspace.new(
              `${verification.username} Workspace`,
              null,
              { chatMode: "automatic" }
            );
            if (workspace) workspaceSlug = workspace.slug;
          }

View on GitHub (pinned to 3aec848f28)

Solutions

1. Re-copy the token from @BotFather exactly (format <numeric bot id>:<hash>), stripping any whitespace or quotes, and retry the connect request.
2. If unsure whether the token is still valid, send /revoke in @BotFather and use the freshly issued token.
3. Validate the token out-of-band: curl https://api.telegram.org/bot<TOKEN>/getMe must return {"ok":true,...}; a 401 confirms the token itself is bad.
4. If getMe fails with a network error (ETIMEDOUT, ENOTFOUND, ECONNREFUSED), fix server outbound access to api.telegram.org (proxy env vars HTTPS_PROXY/HTTP_PROXY, firewall, DNS) and retry.

Example fix

// before
const verification = await TelegramBotService.verifyToken(String(bot_token));

// after - normalize input so pasted quotes/spaces never reach Telegram
const verification = await TelegramBotService.verifyToken(
  String(bot_token).trim().replace(/^["']|["']$/g, "")
);

// Cheap client-side pre-check before POST /telegram/connect
const TELEGRAM_TOKEN_RE = /^\d{6,}:[A-Za-z0-9_-]{30,}$/;
function assertBotToken(token) {
  const t = String(token ?? "").trim().replace(/^["']+|["']+$/g, "");
  if (!TELEGRAM_TOKEN_RE.test(t)) throw new Error("bot_token must look like <botId>:<hash> from @BotFather");
  return t;
}
// Out-of-band verify without connecting:
// const res = await fetch(`https://api.telegram.org/bot${t}/getMe`); if (!res.ok) ...

function isTelegramBotToken(value) {
  return typeof value === "string" && /^\d{6,}:[A-Za-z0-9_-]{30,}$/.test(value.trim());
}

When it happens

Trigger: POST /telegram/connect with a bot_token that is truthy but not a valid active token: token pasted with surrounding quotes, spaces, or a trailing newline; a token revoked via @BotFather /revoke after it was copied; a token for a different bot; or the server cannot open HTTPS to api.telegram.org (proxy/firewall/DNS) so getMe() rejects with ETIMEDOUT/ECONNREFUSED instead of an auth answer.

Common situations: Copy-paste from BotFather including quotes or a newline; regenerating the token and pasting the stale one; corporate egress proxy blocking telegram API; typo in the hash portion; running the connect endpoint from a network where Telegram is blocked.

Related errors

• chatId is required.
• No valid updates provided.
• click requires <x> <y> coordinates
• type requires <text> argument
• key requires <key> argument (e.g. Enter, Tab, Escape)

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/4464adac05d4ba93. Report an issue: GitHub.