TamTam Authentication: API Access and Bot Security (2026)

Authentication overview

TamTam's platform utilizes a Bot API to facilitate integrations and custom bot development. Access to this API is controlled through authentication tokens, which serve as the primary mechanism to verify the identity and authorization of applications making requests. This approach is common in messaging platforms to ensure that automated interactions are secure and originate from legitimate sources OAuth 2.0 Bearer Token usage.

The authentication process for TamTam integrations involves obtaining a unique token, typically associated with a specific bot. This token must be included in every API request to authorize the operation. Without a valid token, API calls will be rejected, preventing unauthorized access to TamTam's messaging and user data.

The TamTam Bot API supports various operations, including sending messages, managing chats, and interacting with users. Each operation requires the bot's token to be present, ensuring that the bot has the necessary permissions to perform the requested action. Developers are responsible for securely managing these tokens to prevent unauthorized use and maintain the integrity of their integrations.

Supported authentication methods

TamTam primarily supports token-based authentication for its Bot API. This method involves a secret access token that identifies your bot and grants it permissions to interact with the TamTam platform. The token acts as a credential, proving the bot's identity during API requests TamTam Bot API documentation.

The API token approach is widely adopted in modern API design due to its simplicity and effectiveness in controlling access. Bearer tokens, a common form of API token, are sent in the HTTP Authorization header with each request. This allows stateless authentication, where the server verifies the token with each request without maintaining session state IETF RFC 6750 on Bearer Tokens.

Getting your credentials

To obtain an API token for your TamTam bot, you typically interact with a dedicated bot creation service within the TamTam platform, similar to a "Botfather" concept found in other messaging applications. This process generates a unique token that your application will use to authenticate with the TamTam Bot API.

1. Start a chat with the BotFather-like service: Open TamTam and search for the official bot creation tool. (Specific name may vary; refer to the latest TamTam official API documentation for the exact bot name).
2. Create a new bot: Follow the on-screen prompts to create a new bot. You will be asked to provide a name and a username for your bot.
3. Receive your API token: Once the bot is successfully created, the BotFather-like service will provide you with a unique API token. This token is a long string of characters that acts as your bot's password.
4. Record your token: Copy and store this token securely. It is crucial for your bot to interact with the TamTam API.

It is important to treat this token as a sensitive credential. Do not hardcode it directly into your application's source code, especially if the code is publicly accessible. Instead, use environment variables or a secure configuration management system to store and retrieve the token at runtime.

Authenticated request example

Once you have obtained your API token, you can use it to make authenticated requests to the TamTam Bot API. The token should be included as a query parameter in your API calls, specifically as access_token. Below is an example using Python to send a simple message.

Python example (using requests library):

import requests

# Replace 'YOUR_ACCESS_TOKEN' with your actual TamTam bot API token
ACCESS_TOKEN = 'YOUR_ACCESS_TOKEN'

# The recipient's chat ID (e.g., a user ID or chat ID where the bot is a member)
CHAT_ID = 1234567890 # Replace with a valid chat ID

# The message text to send
MESSAGE_TEXT = 'Hello from TamTam Bot via API!'

# TamTam Bot API endpoint for sending messages
API_URL = f'https://api.tamtam.chat/messages?access_token={ACCESS_TOKEN}'

# Payload for the message
payload = {
    'recipient': {
        'chat_id': CHAT_ID
    },
    'message': {
        'text': MESSAGE_TEXT
    }
}

try:
    response = requests.post(API_URL, json=payload)
    response.raise_for_status() # Raise an HTTPError for bad responses (4xx or 5xx)

    print(f"Message sent successfully: {response.json()}")
except requests.exceptions.HTTPError as http_err:
    print(f"HTTP error occurred: {http_err} - {response.json()}")
except requests.exceptions.ConnectionError as conn_err:
    print(f"Connection error occurred: {conn_err}")
except requests.exceptions.Timeout as timeout_err:
    print(f"Timeout error occurred: {timeout_err}")
except requests.exceptions.RequestException as req_err:
    print(f"An unexpected error occurred: {req_err}")

This example demonstrates how to construct an HTTP POST request to the TamTam /messages endpoint, embedding the access_token in the URL query string. The message content and recipient are sent in the request body as JSON. Always ensure your bot has the necessary permissions in the target chat to send messages, as outlined in the TamTam Bot API reference.

Security best practices

Securing your TamTam bot and its API token is critical to prevent unauthorized access and maintain the privacy and integrity of your communications. Adhering to established security practices can mitigate common risks.

• Token Confidentiality: Your API token is the primary credential for your bot. Treat it as you would a password. Do not expose it in public repositories, client-side code, or insecure logs.
• Environment Variables: Store your API token in environment variables rather than hardcoding it directly into your application's source code. This practice prevents the token from being committed to version control systems and makes it easier to manage credentials across different deployment environments Google Cloud secure credential management.
• HTTPS Only: Always use HTTPS for all API interactions. TamTam's API endpoints are served over HTTPS, which encrypts data in transit, protecting your API token and message content from eavesdropping.
• Least Privilege: Design your bot to operate with the minimum necessary permissions. If your bot only needs to send messages, do not grant it broader permissions like chat administration. Review and limit your bot's capabilities through the TamTam bot management interface.
• Regular Token Rotation: Periodically regenerate your API token. If a token is compromised, rotating it minimizes the window of exposure. While TamTam's native tools for this may vary, manual rotation through the bot management interface is often possible.
• Input Validation: Implement rigorous input validation for any data your bot receives, especially from users. This prevents common vulnerabilities like injection attacks that could exploit your bot or the TamTam platform.
• Log Minimization: Avoid logging sensitive information, including API tokens or full request/response bodies that might contain user data, unless absolutely necessary for debugging in a secure environment.
• Error Handling: Implement robust error handling in your bot's code. Suppress detailed error messages that might reveal internal architecture or sensitive information to unauthorized parties.
• Secure Hosting: Deploy your bot on a secure and reputable hosting platform that offers features like firewalls, intrusion detection, and regular security updates.