How to Send Website Form Submissions to Telegram

TRY THE WORKING VERSION

Send a test lead

This form uses the same architecture you'll build below. Your browser sends the form to How2Code's Django backend; the backend sends the Telegram message. The bot token never reaches the page.

WHAT WE'RE BUILDING

A small form with a server in the middle

The browser should not talk directly to Telegram with your bot token. Instead, it sends ordinary form data to an endpoint you control. That endpoint validates the submission and makes the authenticated Telegram request.

We're using Django because How2Code runs on Django, but the same boundary works with Flask, FastAPI, Node, PHP, Laravel or a serverless function.

WHAT YOU NEED

Before you start

• A Telegram account
• A website with a backend you control
• Python and Django for this implementation
• A place to store environment variables in production

STEP 1

Create a Telegram bot

Open @BotFather in Telegram, start a chat and run /newbot. Choose a display name and username. BotFather will return an authentication token.

STEP 2

Get the destination chat ID

Send a message to your new bot first. Then call Telegram's getUpdates method from a trusted environment and inspect the returned message object's chat.id.

https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getUpdates

For a group, add the bot to the group and send a message there. Group and supergroup IDs can be negative. Keep the chat ID server-side too: it isn't an authentication secret like the token, but clients do not need it.

STEP 3

Create the website form

Start with normal HTML. This keeps the form usable and understandable before we add any JavaScript enhancement.

<form method="post" action="/contact/">
  {% csrf_token %}
  <label>Name
    <input name="name" maxlength="80" required>
  </label>
  <label>Email
    <input type="email" name="email" required>
  </label>
  <label>Message
    <textarea name="message" maxlength="1000" required></textarea>
  </label>
  <button type="submit">Send</button>
</form>

STEP 4

Create the secure backend endpoint

Django validates the fields before Telegram sees anything. The hidden honeypot is deliberately boring: many automated form bots fill every input they find.

from django import forms

class ContactForm(forms.Form):
    name = forms.CharField(max_length=80, strip=True)
    email = forms.EmailField(max_length=254)
    message = forms.CharField(max_length=1000, strip=True)
    website = forms.CharField(required=False)

    def clean_website(self):
        if self.cleaned_data.get("website"):
            raise forms.ValidationError("Invalid submission.")
        return ""

from django.shortcuts import render
from django.views.decorators.http import require_POST

@require_POST
def contact(request):
    form = ContactForm(request.POST)
    if not form.is_valid():
        return render(request, "contact.html", {"form": form}, status=400)

    send_to_telegram(
        name=form.cleaned_data["name"],
        email=form.cleaned_data["email"],
        message=form.cleaned_data["message"],
    )
    return render(request, "contact_success.html")

STEP 5

Send the message through Telegram Bot API

The authenticated request happens here, on the server. A short timeout matters: if Telegram is temporarily unreachable, your web worker should not hang indefinitely.

import json
import os
from urllib import request

def send_to_telegram(*, name, email, message):
    token = os.environ["TELEGRAM_BOT_TOKEN"]
    chat_id = os.environ["TELEGRAM_CHAT_ID"]

    text = (
        "New website lead\n\n"
        f"Name: {name}\n"
        f"Email: {email}\n"
        f"Message: {message}"
    )
    payload = json.dumps({
        "chat_id": chat_id,
        "text": text,
    }).encode("utf-8")

    req = request.Request(
        f"https://api.telegram.org/bot{token}/sendMessage",
        data=payload,
        headers={"Content-Type": "application/json"},
        method="POST",
    )
    with request.urlopen(req, timeout=5):
        pass

STEP 6

Store secrets outside the code

Set the token and destination as environment variables on the machine or hosting platform running Django.

TELEGRAM_BOT_TOKEN=123456:replace-with-real-token
TELEGRAM_CHAT_ID=123456789

Add local environment files to .gitignore. Never commit the real token. If a token has been exposed, revoke/regenerate it with BotFather rather than merely deleting it from the latest commit.

STEP 7

Make the public endpoint boring to abuse

A production form needs more than a hidden token. Our live demo uses server-side validation, Django CSRF protection, a honeypot, strict length limits, a fixed Telegram destination and request throttling.

STEP 8

Test the failure cases, not only the happy path

• A valid submission reaches Telegram
• Empty name/message is rejected
• An invalid email is rejected
• The bot token is absent from page source and JavaScript
• Repeated submissions are throttled
• A Telegram outage produces a safe user-facing error

STEP 9

Deploy it

The deployment rule is simple: configure the two environment variables where your Django process starts, restart the application, then submit the production form once and verify the message arrives.

[Service]
Environment="TELEGRAM_BOT_TOKEN=..."
Environment="TELEGRAM_CHAT_ID=..."
ExecStart=/path/to/venv/bin/gunicorn config.wsgi:application

FULL WORKING PATTERN

Keep the pieces small

The production pattern is only four responsibilities: HTML collects the data, a Django form validates it, a view controls the request, and a tiny Telegram client owns the external API call. That separation makes each part easy to replace later.

TROUBLESHOOTING

When the form doesn't reach Telegram

POSSIBLE IMPROVEMENTS

Where to take it next

Once the basic path is reliable, you can store leads in your database, send an email fallback, attach page/UTM data, push the same lead into a CRM, or route different forms to different internal chats. Add those because your workflow needs them — not because the first version needs more code.

FAQ

Common questions